Air transportation safety investigation report A98H0003

SR 111 departed New York on a regularly scheduled flight, and was being flown by a qualified crew in accordance with applicable regulations and procedures. Documentation indicates that the aircraft was equipped, maintained, and operated in accordance with applicable Joint Aviation Authorities (JAA) regulations.

Records did not reveal any pre-existing medical condition that could have affected the performance of the SR 111 flight crew. Prior to departure, the pilots were reportedly well rested and in good spirits. The crew had received the required duty rest prescribed by regulations; fatigue was considered to not have been a factor in this occurrence.

At some point along the flight route, a failure event occurred that provided an ignition source to nearby flammable materials leading to an in-flight fire. The fire spread and increased in intensity until it led to the loss of the aircraft and human life. The primary factors involved in this occurrence include

• the condition that resulted in the ignition source;
• the flammable materials that were available to be ignited, sustain, and propagate the fire;
• the subsequent fire-induced material failures that exacerbated the fire-in-progress;
• the lack of detection equipment to enable the crew to accurately assess the source and significance of the initial smoke; and
• the lack of appropriate in-flight firefighting measures required to deal successfully with the smoke and fire.

Although data confirms that in-flight fires that result in fatal accidents are rare, many of the same factors listed above were not unique to this aircraft model, airline, or crew.

All ground-based navigation equipment was reported to be serviceable and functioning normally. The Aircraft Firefighting Services at Halifax International Airport were alerted and responded in a timely manner to the vehicle standby positions on the airfield.

The high-energy collision with the water, and the destruction of the aircraft, precluded a complete and detailed inventory of the aircraft's structure and components. However, measuring by structural weight, 98 per cent of the aircraft was recovered. All extremities of the aircraft surfaces were accounted for in the main wreckage field on the ocean floor, indicating that the aircraft was intact when it struck the water.

The search and rescue response was rapid and comprehensive. The disaster response, which involved multiple government departments and agencies, and local citizens was implemented in a timely and effective manner.

The Swissair security policies, procedures, and practices that were in place at John F. Kennedy (JFK) International Airport for the SR 111 flight were examined by the Royal Canadian Mounted Police (RCMP) and Transportation Safety Board of Canada (TSB) investigators. No shortfalls were found. Aircraft and passenger security was not an issue in this occurrence.

All recovered aircraft-related material was examined by fire and explosion experts from the RCMP; they discovered no evidence to support the involvement of an explosive or incendiary device, or other criminal activity.

The coordination between the pilots and the cabin crew was consistent with company procedures and training. The crew communications reflected that the situation was not being categorized as an emergency until about six minutes prior to the crash; however, soon after the descent to Halifax had started, rapid cabin preparations for an imminent landing were underway.

2.2.1 General

Significantly more recorded information could have been readily available with improved on-board data capture equipment. Improvements in the quantity and quality of recorded information can significantly shorten the investigation duration, and increase the opportunities for identifying safety deficiencies.

2.2.2 Cockpit voice recorder

2.2.2.1 Cockpit voice recording duration

The 30-minute cockpit voice recorder (CVR) recording on SR 111 was insufficient to provide the amount of data needed to fully analyze all of the factors that may have played a part in the occurrence or that could have led to the identification of further safety deficiencies. Longer audio recordings can provide additional background information to assist in assessing the relevance and importance of events, isolating the information that has a direct bearing on the occurrence, and resolving investigation issues more quickly. In the absence of audio recordings, such evaluations using other means can consume considerable time and resources. A minimum two-hour CVR recording capability would have enabled a quicker and possibly more in-depth assessment of events that occurred earlier in the flight. For example, the investigation would have benefited considerably if CVR information had been available to help analyze earlier events such as the time period of the 13-minute, very-high frequency (VHF) communications gap.

The JAA has implemented Joint Aviation Requirements (JAR)-OPS 1.700, which require that airline transport category aircraft certified after 1 April 1998 be equipped with a two-hour CVR recording capacity. However, the MD-11 was certified in 1991; therefore, only a 30-minute recording capacity for SR 111 was required and applied under JAR-OPS 1.710. The United States of America and Canada still only require a 30-minute CVR duration for transport category aircraft.

2.2.2.2 Recorder electrical power source

Had the CVR been equipped with an independent power source to allow for continued operation after its aircraft electrical power source was lost, the resulting additional recorded information could have facilitated a more thorough understanding of the circumstances faced by the crew in the final minutes prior to the crash, and permitted an evaluation of the associated potential safety deficiencies.

In aircraft where the CVR and the flight data recorder (FDR) are both powered from the same aircraft generator bus, both recorders would stop recording at the same time if that generator bus went off-line. Although the current requirement to power the recorders from the most reliable bus available seems prudent in principle, it leaves both recorders vulnerable to a single-point electrical failure. Powering the recorders from separate buses, with some separation of the wiring and separation of respective circuit breakers (CB), would provide an opportunity for one recorder to remain powered in the event of the loss of a bus, and therefore, improve the likelihood that additional useful information would be recorded.

2.2.2.3 Clarity of CVR recording

Some portions of the recording from the cockpit area microphone channel of the CVR that were potentially important to the investigation were difficult to decipher. Experience with numerous other CVR recordings confirms that it is significantly easier to decipher the words when flight crews use their boom microphones. The improved clarity results in significant time saving during investigations, increased transcription accuracy, and higher likelihood of identifying and validating safety deficiencies. Currently, there is no regulatory requirement for the use of boom microphones in all phases of flight, nor is such usage standard practice among airline companies.

2.2.3 Survivability of quick access recorder information

As is typical with most quick access recorders (QAR), the QAR in SR 111 recorded significantly more data than did the FDR. The QAR tape was damaged beyond use; therefore, no information was available from this potentially valuable source. The number of parameters that would have been recorded on the SR 111 QAR exceeded by fourfold those that were recorded on the FDR. Some of those parameters included temperatures in some of the hidden areas and electrical voltages of various aircraft systems. Such information, if stored on the crash-protected FDR, would have been useful to the investigation by providing significant clarification regarding the ignition source and propagation of the in-flight fire.

Modern digital FDRs are technically capable of recording all QAR data from various aircraft sources in a crash-protected environment; however, there is no regulatory requirement that modern FDRs record QAR data.

2.2.4 Image recording

Although regulations do not require the recording of cockpit images, it is technically feasible to do so in a crash-protected manner. Recorded images could provide additional valuable information about crew actions, equipment failures, settings, selections, aircraft flight display information, location of smoke, and other elements that could help more clearly ascertain what took place. Such information could be used to more quickly and effectively determine what happened so that safety deficiencies are more reliably identified.

Much of the interaction that occurs within the cockpit is done by non-verbal means. Without recorded cockpit images, information must be gleaned and deduced by piecing together information from observations made during wreckage examination, and from the CVR and FDR recordings. Although the information obtained from these recording devices can be of significant value, the recordings often provide only partial and unclear information. Frequently, the information does not provide the context of the events, or does not provide sufficient detail for efficient and effective safety investigation purposes. Recorded cockpit images on SR 111 would have provided useful additional information, and added clarity to the understanding of the sequence of events.

2.2.5 Underwater locator beacons – Bracket attachments

The underwater locator beacon (ULB) bracket attachments for the flight recorders remained attached to the recorders; however, the ULBs were damaged to the extent that they had nearly detached. Had the ULBs detached from the recorders, there would be a risk of delaying or preventing the recovery of the recorders. Existing regulations do not require that ULB attachments meet the same level of crash protection as other data recorder components.

2.3.1 Flammability of materials

The most significant deficiency in the chain of events that resulted in the crash of SR 111 was the presence of flammable materials that allowed the fire to ignite and propagate. Testing conducted during the investigation showed that several materials located in the heat-damaged area were flammable, even though they met regulatory standards for flammability. The metallized polyethyelene terephthalate (MPET)–covering material on the thermal acoustic insulation blankets (insulation blankets) used in the aircraft was flammable. This was the most significant source of the combustible materials that contributed to the fire. The MPET–covered insulation blanket was also most likely the first material to ignite. Other materials in the area of the fire damage were also found to be combustible and to have contributed to the propagation and intensity of the fire. These materials included silicone elastomeric end caps; hook-and-loop fasteners; foams; adhesives; and different kinds of splicing tapes used in the construction, installation, and repair of insulation blankets.

The certification testing procedures mandated under flammability standards that existed at the time of the occurrence were not sufficiently stringent or comprehensive to adequately represent the full range of potential ignition sources. Nor did the testing procedures replicate the behaviour of the materials when installed in combination, or in various locations and orientations, as they are found in typical aircraft installations and realistic operating environments. The lack of adequate standards allowed materials to be approved for use in aircraft, even though they could be ignited and propagate flame.

Two primary factors shaped the flammability standards in place at the time of the occurrence.

1. The approach taken by the Federal Aviation Administration (FAA) in the mid-1970s to concentrate its fire prevention efforts in the following two areas: improved cabin interior materials and higher standards for materials in designated fire zones.
2. A lower priority assigned to fire threats in other areas. The non-fire-zone hidden areas were viewed as benign from a fire hazard perspective, as they were seen to be free of the combination of the two elements needed for a fire: a potential ignition source and flammable materials.

The ground fire incidents involving the MPET and non-metallized polyethylene terephthalate insulation blanket cover material that led McDonnell Douglas to reassess its flammability testing of insulation blankets did not trigger mitigating action by regulators. Testing by the manufacturers, the Civil Aviation Administration of China (CAAC), and the FAA showed that these materials could ignite and burn; however, the FAA's follow-up on this issue did not include mandating action to mitigate the potential fire threat. Although McDonnell Douglas stopped using MPET-covered insulation blankets in its production aircraft, and issued a Service Bulletin recommending that operators replace it with a different material, neither the FAA nor other airworthiness authorities required its removal from in-service aircraft until after the release of the safety recommendations made by the TSB following the crash of SR 111.

In 1996, the CAAC pointed to the flammability of the materials as a safety issue in its investigations into two separate in-flight fire occurrences. However, other investigations involving aircraft fires in which MPET-covered insulation blankets were involved typically focused on the ignition source rather than the flammable material. Those investigations did not highlight the safety deficiency posed by the flammable materials.

Ultimately, the in-service flammability performance of MPET-covered insulation blankets prompted an FAA-led research program to quantify the deficiency and develop a specific flammability test for thermal acoustic insulation materials. More than two years of research resulted in the FAA proposing the adoption of the more stringent test, entitled the Radiant Panel Test (RPT). This test exposes the materials to a more realistic in-flight fire scenario and effectively imposes a "zero" burn requirement. Validation of the RPT confirmed that MPET-covered insulation blankets were highly susceptible to flame propagation when ignition occurs from a small ignition source. This confirmation prompted the FAA to issue Airworthiness Directives (AD), applicable to US-registered aircraft, that state that "a determination be made of whether, and at what locations, metallized polyethylene terephthalate (MPET) insulation blankets are installed, and replacement of MPET insulation blankets with new insulation blankets" and "[t]he actions specified by this AD are intended to ensure that insulation blankets constructed of MPET are removed from the fuselage." Although these ADs are enforceable only with respect to US-registered aircraft, most other regulatory authorities throughout the world generally follow the FAA's lead and endorse FAA ADs.

While MPET-covered insulation blankets are identified as the most vulnerable, the research also established that many other widely used thermal acoustic insulation cover materials did not meet the requirements of the RPT. Furthermore, the ADs that call for the removal of MPET-covered insulation blankets warn that other cover materials, although harder to ignite, burn in a similar manner as MPET-covered material. The TSB has expressed concern about the flammability characteristics of other materials that were approved under the same testing procedures used to certify the MPET. Many of these cover materials have been shown to be flammable in subsequent testing.

Most aircraft crews are likely unaware that under certain conditions, a fire could ignite significant flammable materials in hidden areas of aircraft and spread rapidly. Had the pilots been aware that flammable materials were present in the attic space of the MD-11, this knowledge might have affected their evaluation of the source of the odour and smoke.

2.3.2 Contamination issues

Several Swissair MD-11s were inspected for potentially flammable contaminants in the area where the fire is believed to have started; little or no contamination was observed in this area. It was determined by testing that the materials involved in the initiation of the SR 111 fire were flammable in their newly installed condition; therefore, contamination was discounted as a factor in the initiation of the fire.

Although it is intuitive that the presence of contamination on the surface of a material could have a negative affect on its flammability characteristics, additional testing is required to quantify the risk.

2.3.3 Non-fire-hardened aircraft systems

Prior to the time of the SR 111 occurrence, regulators and manufacturers perceived minimal in-flight fire threat in areas other than the passenger cabin areas and designated fire zones. Therefore, certification standards did not account for the potential consequences of a fire-related breach or failure of an aircraft system in areas such as the attic space. This deficiency allowed systems to be constructed in a way that a fire-related component failure could potentially exacerbate the fire.

In a fire environment, a breach in a system, such as the hydraulic, oxygen, or air environmental systems, could significantly add to the severity of the fire by increasing the amount of combustible material, adding oxygen, or modifying the airflow in the area. For aircraft certification, defences against such failures are typically put in place as a result of a system safety analysis of the potential hazards. The system safety zonal analysis conducted on the MD-11 for the area where the fire occurred in SR 111 did not include the hazards resulting from system or component failures caused by a fire-in-progress. Regulations did not ensure that such hazards be included in the system safety analysis. The breach of an elastomeric end cap in the air conditioning duct system, and possibly a failed aluminum cap in the flight crew oxygen system, would have allowed these systems to exacerbate the in-flight fire.

Large transport aircraft are designed according to a standard that requires built-in fire detection and suppression systems only in designated fire zones, such as engines and auxiliary power units, and in potential fire zones, such as lavatories and cargo compartments. That is, only in these areas are risks from the combination of potential ignition sources and flammable materials recognized to co-exist to the extent that detection and suppression systems are required by regulation. Other areas, such as in the hidden areas above the cockpit ceiling and cabin attic space in the MD-11, have been shown to be at risk from fire because they also contain flammable materials and potential ignition sources. The FAA was aware of the existence of flammable materials and potential ignition sources in these areas; however, it assessed the risk of fire as minimal. Current standards do not require these areas to have built-in smoke/fire detection and suppression features. Therefore, detection of smoke or fire in other than designated fire zone and potential fire zone areas is totally reliant on human sensory perception. In areas such as the attic space, normal airflow patterns and highly effective air filtering systems can isolate odours or smoke, and significantly delay their detection.

The MD-11 was not required to have built-in fire suppression features in areas other than the designated fire zones and potential fire zones. Nor was the aircraft required to have access panels or other alternative methods to allow for firefighting in hidden areas. Without built-in fire suppression, or access to currently inaccessible areas by crews to use fire extinguishing equipment, the opportunities to control fires in those areas are limited. Even if the SR 111 crew had known the source of the smoke early in the event, it would have been a significant challenge for them to gain access to the attic area where the fire was underway. By the time the general location of the fire became known in the last few minutes of the flight, it would have been unlikely that they could have accessed the attic area and been able to control or extinguish the fire using the hand-held fire extinguishers. It is unknown whether such an attempt was made.

Initially, the crew was unaware that smoke was present in the hidden areas above the cockpit ceiling and cabin attic space. After the smoke was detected in the cockpit, communications took place between the pilots and the cabin crew. However, there was no recorded mention of smoke having been detected in the cabin at any time before the CVR stopped recording. If smoke had been detected in the cabin area, it is expected that the cabin crew would have relayed this information to the pilots.

Reliance on human detection was inadequate, as the location and extent of the smoke and fire was not discerned by the aircraft crew until the fire was uncontrollable using available firefighting means. The crew members were significantly hampered in their ability to deal with the fire situation owing to the lack of built-in detection and suppression equipment in the area of the fire.

At the time of the SR 111 occurrence, the aviation industry (manufacturers, regulators, operators, and associations) did not treat the issue of in-flight fire protection as a "system" of inter-related measures; that is, there was no requirement for an overall assessment of various fire-related defences. Such an assessment would examine the interactions between the crew, the procedures, the materials and equipment, and would take into account how the various elements could work together to prevent, detect, control, and eliminate fires. In such an approach, separate elements would be evaluated together in a harmonized manner, including material flammability standards, accessibility into hidden areas, smoke/fire detection and suppression equipment, crew emergency procedures, and training.

No major initiatives had been established to assess all components together, or to evaluate their inter-relationships with a view to developing improved, coordinated, and comprehensive firefighting measures. There was a lack of integration of the various potential measures to combat in-flight fires.

Lessons learned from accidents involving in-flight fires have resulted in various changes to flight procedures and aircraft equipment design.^{Footnote 115} However, the changes aimed at providing better firefighting measures have generally been made in isolation, rather than in a fully integrated and comprehensive manner. Considerable industry efforts have been made to prepare and equip aircraft crews to handle some types of in-flight fires (e.g., readily accessible passenger cabin fires). However, these efforts have fallen short of adequately preparing aircraft crews to detect, locate, access, assess, and suppress in-flight hidden fires in a rapid, coordinated, and effective manner.

2.6.1 In-flight firefighting

The training received by the crew of SR 111 was consistent with industry norms; however, it did not prepare them to recognize or combat the in-flight fire. Pilot training focused on eliminating the threat from smoke in the aircraft, whether from an air conditioning or electrical source, by using the checklists provided. It was not anticipated within the aviation industry that aircraft crews could be confronted with a fire in the attic area of an aircraft. Neither were crews trained to appreciate how quickly in-flight fires can develop into uncontrollable situations. Instead, simulator training tended to reinforce a positive outcome to smoke-related events; typically the actions taken by the pilots during the simulator exercise would result in the smoke quickly dissipating. Procedures and pilot training were typically based on the premise that potential ignition sources can be successfully dealt with by procedures that isolate the source. There was little emphasis on the possibility that a fire may have already started by the time smoke is detected, or that once a fire has started, it may not be isolated or eliminated by existing checklist procedures.

At the time of the SR 111 occurrence, there was an expectation within the industry that crews would be able to distinguish, with a high degree of certainty, between smoke emanating from an air conditioning source and smoke being generated by an electrical malfunction. At Swissair, it was felt that once the pilots had made this distinction, and they were certain that the source was related to air conditioning, it would be appropriate to select the Air Conditioning Smoke checklist. However, it is an invalid assumption that human sensory perception is capable of consistently differentiating between smoke initiated by an electrical source, by an air conditioning source, or by the by-products of the combustion of other materials.

Swissair flight crews trained together with cabin crews and met industry standards for dealing with readily accessible fires in the passenger cabin area, such as fires in galleys or lavatories. None of the firefighting training included firefighting in the cockpit, avionics compartment, or in hidden areas behind panels or above the cockpit or cabin ceiling area. In general, pilots are not expected to leave their flying duties to engage in firefighting outside the cockpit. This expectation is consistent with industry norms, which dictate that the cabin crew fight the fire so that the pilots can continue to fly the aircraft.

The flight crews were trained to react to emergencies with a measured response, commensurate with the perceived threat. The SR 111 pilots would be expected to react to the appearance of the smoke by completing the Power, Performance, Analysis, Action functions, and by developing and executing a plan of action based on their appreciation of the situation. Although this item was discussed and pointed out in the respective simulator training sessions, no specific training or direction was provided regarding the urgency of starting a checklist and confirming by all possible means the type and seriousness of a smoke or fumes event.

Cabin crews were trained to locate and extinguish in-flight fires, but their training was limited to those areas of the aircraft that are readily accessible. This training would not prepare cabin crew members for firefighting in the attic area or other hidden areas. Further, cabin crews were not specifically trained to fight fires in the cockpit or avionics compartment area.

2.6.2 In-flight emergency diversions

Swissair pilots were directed, through information provided in the Swissair General/Basics: Flight Crew Manual, to land at the nearest emergency airport if confronted with persistent smoke from an unknown source. These directions did not indicate that an emergency diversion was to be initiated immediately, or that any smoke should be assumed to be an in-flight fire until proven otherwise. Therefore, in the presence of smoke, crews were expected to classify the smoke, select the appropriate checklist, and divert the aircraft when warranted.

The SR 111 pilots quickly investigated the situation and made a timely decision to divert the flight, even though, based on the perceived cues, the situation was not classified as an emergency.

2.7.1 Swissair checklist options for smoke isolation

The issue of having two, versus one, emergency smoke isolation checklist was examined to assess whether having a choice between two checklists could have affected the outcome of the occurrence. For this to have been a factor, it would have to be assumed that the pilots would have reacted differently had Swissair procedures incorporated a single checklist for smoke/fumes of electrical, air conditioning, or unknown origin. The pilots assessed the smoke to be from an air conditioning source and did not deem the smoke to be enough of a threat to complete the Air Conditioning Smoke checklist. Therefore, it seems unlikely that the pilots would have performed the single checklist any earlier.

Providing a choice of two emergency smoke checklists to deal with smoke isolation presupposes that it is possible to assess the type of smoke with certainty. The SR 111 occurrence illustrates that an accurate evaluation of smoke type is not always possible using human sensory perception.

2.7.2 Emergency electrical load-shedding

The pilots initially assessed that the smoke was originating from an air conditioning source. Having made this determination, there is no indication that they immediately initiated any checklists. Even if they began immediately with the Smoke/Fumes of Unknown Origin Checklist, it would not likely have affected the fire scenario, as the fire is believed to have been self-propagating by the time the smoke appeared in the cockpit. However, there are circumstances where a rapid de-powering of electrical systems might prevent a fire by removing the ignition source before any combustible materials ignite.

No regulatory requirement exists for transport category aircraft to be designed to allow for a checklist procedure that de-powers all but essential electrical equipment for the purpose of eliminating a potential ignition source. Checklists that are used for electrical load-shedding, such as the MD-11 Smoke/Fumes of Unknown Origin, are intended to isolate a malfunctioning component that is generating smoke or fumes. The associated checklist actions could take up to 30 minutes or more, depending on how early in the checklist procedure the malfunctioning component is deactivated.

No regulatory requirement exists to govern the length of time that checklists designed to deal with odour or smoke events could take to complete. The 20 to 30 minutes typically required to complete the Smoke/Fumes of Unknown Origin Checklist in the MD-11 could allow an electrical malfunction that is generating smoke and increasing heat energy to develop into an ignition source. To be effective in helping prevent the initiation of a fire, a checklist procedure must quickly eliminate the ignition source before a fire has become self-sustaining.

2.7.3 Additional checklist issues

The deviations noted with the Swissair Smoke/Fumes of Unknown Origin Checklist had the potential to be problematic. However, the only direct connection that could be established with the SR 111 scenario was the darkened cabin that resulted from the emergency lighting in the passenger cabin going off when the CABIN BUS switch was selected by the pilots. Working in a darkened cabin could have delayed the cabin crew preparations for an emergency landing by necessitating the use of flashlights. However, there was a cabin emergency lights switch installed at the flight attendant station normally occupied by the maître de cabine (M/C). The use of this switch would have restored the emergency lighting and eliminated the need to temporarily use flashlights. It is unknown whether this cabin emergency light switch was used.

There is no indication that the decisions made by the pilots were affected by the absence of direction in the checklist to don oxygen masks. It is unknown whether the pilots would have initiated an emergency diversion earlier if there had been a single, combined checklist with one of the first items being related to preparing to land expeditiously. It could not be determined whether they were inhibited by the size of the font or any glare from the checklist, although either of these conditions could affect the ability of flight crews to read the checklist, especially in a smoke or low-light environment.

A review of several checklists showed a lack of emphasis on treating any amount of smoke in an aircraft as a serious fire threat. For example, neither the Swissair nor the McDonnell Douglas Smoke of Unknown Origin Checklist stipulated that preparations for a possible emergency landing should be considered immediately when smoke of unknown origin appears. Rather, on both versions, the reference to landing is the last action item on the checklist. Similarly, the Swissair guidance provided to flight crews was that the aircraft was to land at the nearest emergency airport if smoke of unknown origin was "persistent."

2.7.4 Checklist revisions and approvals

Swissair representatives consulted with McDonnell Douglas when they decided to retain two MD-11 smoke checklists and revise the Smoke/Fumes of Unknown Origin Checklist; however, no formal change approval was required by the Swiss Federal Office for Civil Aviation (FOCA).

During the investigation, the maintenance condition of the aircraft was assessed by reviewing the aircraft's maintenance records and SR Technics maintenance policies, procedures, and practices.

The records for the occurrence aircraft indicate that required maintenance had been completed, and that the aircraft was being maintained in a manner consistent with approved maintenance procedures and industry norms. Although several "bookkeeping" anomalies were found, the overall method of record-keeping was sound.

The condition of the SR 111 wreckage did not allow for a full determination of the pre-occurrence condition of the aircraft. Therefore, investigators inspected several MD-11s, including those in the Swissair fleet, and used the information from these inspections to help assess the potential ignition sources. During these inspections of the MD-11s, various discrepancies were noted in the installation and maintenance of the electrical system, including chafing on wires, incorrectly torqued terminal connections, and inconsistent wire routing. None were considered to affect the immediate safety of flight. Some of the discrepancies could be attributed to the manufacturer of the aircraft, and others to subsequent installations and ongoing maintenance.

The SR Technics quality assurance (QA) program satisfied regulatory requirements. It involved a multi-faceted approach that relied on training, trend analysis, reliability, and structured audits. The number and type of anomalies discovered during the investigation, which included a review of the findings of the various internal and external audits, suggest that while the QA program design was sound, its implementation did not sufficiently ensure that potential safety aspects were consistently identified and mitigated.

The SR Technics maintenance organization exposition (MOE) required that all employees be trained to be personally responsible for the quality of their work; that is, the work was expected to be accomplished correctly, and a self-inspection was to be completed after each "work step." Whenever work was carried out where the consequences of a mistake in doing the work presented a risk to persons or material (as determined by a risk assessment team), a double inspection was called for. Supervisors were to ensure that the QA program was being followed, and were to inspect the quality of the work in their area of supervision. Individuals received general QA instructions and familiarization training on documentation, policies, and procedures, but did not receive (nor did the MOE make reference to) specific training on how to consistently implement the QA program. The primary task of those involved in the day-to-day QA activities was to maintain the aircraft. There are indications that they dealt with some of the various technical discrepancies and anomalies as reliability issues rather than potential safety deficiencies. Although regulatory requirements were met, some aspects of the QA program were not consistently implemented.

A post-occurrence SR Technics review of its own QA program determined that a weak link in its program was the reliance on individual judgment. This observation had not been made in any of their previous internal audit findings. Although judgment plays a role in any QA program, it appears that the SR Technics QA program was over-reliant on the ability of individuals to identify potential safety deficiencies while they continued to try to meet productivity targets.

Although the SR Technics QA program had a follow-up process for safety issues, as defined in the MOE, the implementation of the program was such that opportunities to identify potential safety issues were at times missed; as a consequence, safety-related follow-up was not undertaken on these occasions. For example, the map light anomalies were handled as a reliability issue; they were not identified as having flight safety implications.

The investigation did not attempt a direct comparison study to determine how the SR Technics QA program compared to QA-related programs at other operators. However, information was available from an FAA National Program Review report in which it completed a review of the maintenance organizations of nine of the largest S airlines.^{Footnote 116} The observations suggest that shortcomings identified in the SR Technics QA program were not unique. The FAA concluded that while the current state of the mandated QA-related programs in those nine airlines did not constitute an unsafe condition, each of them would benefit from reviewing and adapting their individual QA programs with the FAA's optimized model of the Continuing Analysis and Surveillance System (CASS) program. Similarly, analysis of the SR Technics QA program did not identify immediate flight safety concerns or unsafe conditions, although the program was not always effective in highlighting and resolving potential safety-related aspects.

The observations of the National Program Review results, by the US Department of Transportation's Office of the Inspector General (OIG), were of interest to this investigation. The OIG concluded that, in its oversight of the various CASS programs, the FAA focused primarily on whether the program had all the required elements, rather than on whether it was effective in detecting potential problems. The OIG made various recommendations that would require improved training, monitoring, and analysis of the CASS program. Analysis of the results of the FOCA audits of SR Technics showed a similar trend.

The similar nature of various FOCA audit findings indicates that they concentrated on ensuring that the QA program had the required elements. The findings tended to identify symptoms, rather than the underlying factors manifested in the recurring findings. Typically, the audits each contained several findings that questioned the adequacy and quality of personnel training, or the implementation and compliance of established practices and procedures. The FOCA accepted SR Technics' corrective actions, but made similar findings on subsequent audits. It was also noted that typically, the FOCA findings were comparable to those of the internal SR Technics audits.

See the supporting technical information on this topic.

The MD-11 certification process included tests to demonstrate an acceptable level of aircraft systems protection against the effects of high-intensity radiated fields (HIRF). The test conditions represented radiated field strengths that vastly exceed the maximum field strengths produced by all known commercial and military radars that were operating in proximity to the occurrence aircraft. Similarly, no hypothetical combination of known emitters and realistic distance separation geometry can be shown to exceed the field strength criteria used during MD-11 HIRF certification testing.

After leaving the airspace of JFK airport, the most significant HIRF environment encountered by SR 111 was in the vicinity of Barrington, Nova Scotia. The HIRF field strength near Barrington, in the environment external to the aircraft, was approximately 100 times weaker than the estimated peak field strength encountered by aircraft during normal approach and landing conditions at typical large, well-equipped airports. Therefore, it is probable that the normal operating environment around JFK airport was the most severe HIRF environment encountered by the aircraft during any portion of the occurrence flight.

The normal HIRF environment at JFK airport does not represent a hazard to aviation, as demonstrated by the uneventful arrival and departure of many aircraft each day, including previous flights by the occurrence aircraft. In addition, the minimum field strength required to induce an electrical discharge between exposed conductors (31 kilovolts per centimetre at sea level) is more than 1 000 times greater than the peak field strength associated with normal airport HIRF environments, and about 430 times greater than the theoretical worst-case HIRF environment for a commercial aircraft.

Resonance effects could not have produced localized field gradients of sufficient strength to induce an electrical discharge between exposed conductors. The required gain factor to the ambient field strength is approximately three orders of magnitude (about 1 000 times greater), whereas resonance gain factors rarely exceed one order of magnitude.

Radio frequency (RF) spectrum allocations are developed to ensure that authorized high-power RF sources will not interfere with aircraft radios and radars; therefore, it is unlikely that the 13-minute communication gap was caused by interference from a HIRF emitter. In any case, no technically feasible link exists between HIRF-induced VHF radio interference and an electrical discharge event leading to the ignition of flammable materials. Therefore, HIRF was considered not to be a factor in this occurrence.

Anomalies with the aircraft communications addressing and reporting system (ACARS) were evaluated for any possible connection to the technical failure event that preceded the in-flight fire. The first indication of an ACARS anomaly was the non-recording of the ACARS tracker message at about 0031:18, more than 39 minutes prior to the detection of the unusual odour in the cockpit (see Section 1.18.8.2).

The two ACARS tracker messages that were expected at about 0031:18 and 0041:18 were not recorded by the ACARS system providers; however, the count update information obtained from subsequent ACARS messages shows that these two messages had been sent from the aircraft. The most plausible explanation is that the ACARS system logged onto another network, as would happen if the system that was initially being used became saturated. No data was available to confirm this hypothesis.

The communications system in the MD-11 incorporates redundancy, in that it has three VHF communication paths available. It would take a complete failure of the entire system before communication capability would be lost. This could happen with a failure of the digitally controlled audio system (DCAS); however, this eventuality is unlikely in that the DCAS worked normally after communication had been re-established. The only other circumstance that would completely disable the communications system would be the simultaneous failure of all nine push-to-talk switches; this is considered unfeasible. Therefore, it is highly unlikely that the communications gap was related to a technical failure.

The most plausible explanation for the 13-minute communications gap is that the pilots selected an incorrect frequency during the attempted frequency change between 0033:12 and 0033:21. The communication sequence leading up to this frequency change differed from previous and subsequent frequency changes in that following the first instruction by ATS to change to a different en route frequency, only a short, clipped, unintelligible communication was heard from SR 111. However, when the new frequency assignment was repeated by the controller, SR 111 immediately acknowledged in a normal manner by repeating the assigned frequency. The subsequent keying events on both VHF 1 and VHF 2 that were recorded by the FDR during the communications gap are consistent with attempts by the pilots to re-establish radio contact. As frequency settings are not recorded on the FDR, it is not known which frequency the pilots were attempting to use.

When the pilots eventually re-established contact, it was on an unassigned frequency, and they made no mention of a technical problem. There is no record of any subsequent radio communication difficulties until after the effects of the fire had started to also affect other aircraft systems, about 40 minutes later.

The loss of ACARS on VHF 3 at 0047:06 can be explained by the pilots switching VHF 3 from data mode to voice mode in an attempt to use this radio for communications. The message protocol data from the ACARS provider indicates that the pilots must have switched VHF 3 to voice mode at 0047:06 when the ACARS changed to the satellite mode of transmission; the pilots then switched VHF 3 back to data mode at 0104:14.

The odour in the cockpit of SR 111 was initially detected about 37 minutes after the start of the VHF communications gap, and about 24 minutes after communication had been restored. No connection could be established between the ACARS anomalies, the 13-minute VHF communications gap, and the ignition of the fire in the aircraft.

The design deficiencies of the Hella map light resulted in the potential for electrical arcing in typical in-service conditions. Normal rotation of the lens housing allowed contact between the insulating protective cap and the carrier frame; over time, usage would result in damage to the protective cap exposing the positive terminal metal contact spring. This situation provided an opportunity for the exposed metal contact spring to arc to the carrier frame. The design also created at least three additional opportunities for electrical arcing, including during bulb replacement maintenance activity.

Also, the map light installations at the pilot and co-pilot positions in the MD-11, were located in confined areas near, or in direct contact with, combustible materials that could exacerbate the consequences of any potential arcing. The overheat damage observed on several MPET-covered insulation blankets examined in other MD-11s, reflected the heat build-up behind the map lights. The combination of radiant heat and close proximity would increase the probability of igniting the MPET-covered insulation blankets during an arcing event.

The map lights were not involved with the origin of the SR 111 fire; however, the deficiencies found in both the map light design and its MD-11 installation presented unacceptable risk. These safety deficiencies are being eliminated by the follow-up actions underway (see Section 4.1.4).

2.13.1 Circuit breaker technology

The arced in-flight entertainment network (IFEN) power supply unit (PSU) cables were protected by conventional CBs typical of those used in the remainder of the aircraft and throughout the aviation industry. Two of the PSU cables (exhibits 1-3790 and 1-3791) had arcing events that did not trip the associated CB. It is most likely that the CBs did not trip because the electrical characteristics of the arcs were outside the defined Time versus Current curve.

Conventional aircraft CB technology can provide protection against hard short-circuit faults, but is limited in that it does not adequately protect against the full range of arc faults.

Industry and government are presently engaged in various research and development efforts aimed at designing a CB that will detect and react to the full range of known arc fault events, including short duration arc faults that typically occur outside the defined Time versus Current curve of traditional CBs. The resulting Arc Fault Circuit Breaker (AFCB) is being designed to surpass the protection provided by traditional thermal CBs. While the new circuit protection devices will mitigate the wire damage from successive arcing events on the same wire, ignition of surrounding flammable material may still occur from the initial arcing event.

Theoretically, had an AFCB been available to protect the IFEN PSU cables, the initial arcing events on exhibits 1-3790 and 1-3791 would have been detected by the AFCB, and the device would have tripped and de-energized the cable.

While the proposed AFCB certification tests will result in improved arc-fault detection capabilities and response times, as written they will not certify the AFCB's ability to prevent the ignition of flammable materials by arcing phenomena. Given the existence of flammable materials used in aircraft construction, it would be prudent to establish AFCB certification criteria based on limiting the arc energy to a level below that necessary to ignite any materials likely to be used in aircraft. Although such testing standards have been incorporated for residential arc fault circuit-interrupters, draft certification test requirements for aircraft AFCBs do not include such criteria.^{Footnote 117}

2.13.3 Circuit breaker maintenance

As a result, in part, of the CB's inherent reliability, preventive maintenance is rare and largely confined to a general visual inspection and cleaning, as required. When a CB experiences a failure, it is typically confined to one of two modes: the CB either exhibits nuisance trips, or it fails to trip when exposed to an over-current condition. Maintenance action in either case is usually confined to replacement of the faulty CB. While both failure modes are undesirable, the failure of a CB to trip leaves the associated wire or cable unprotected. Analysis of the failed CBs has revealed that, in some instances, long periods of inactivity can cause the CB's trip characteristics to change with time.^{Footnote 118}

According to both the FAA and the Society of Automotive Engineers, this CB aging phenomenon can be prevented by the periodic cycling of the CB mechanism. Despite such recommendations, aircraft maintenance programs do not typically include a requirement to "exercise" CBs on a periodic basis. In its recently published bulletin on the issue of resetting tripped CBs, the FAA made no mention of the adequacy of the various operators' CB preventive maintenance programs. Addressing the practice of periodic CB cycling would help those responsible for CB maintenance programs to ensure that their programs are consistent and optimized to provide maximum CB reliability. There is a need for the aviation industry to identify a "best practices" approach to CB maintenance and to ensure that CB maintenance programs are designed appropriately.

2.13.4 Electrical wire separation issues

2.13.4.1 FAR 25.1353(b) requirements

From a wire separation perspective, no linkage was found between the design of the MD-11 wire routing and the source of the ignition for the in-flight fire. However, because all six power bus feed cables are routed together near the overhead switch panel housing, the design provided an increased opportunity for all the services supplied by these cables to be lost as a result of a single-point failure. It was established that the loss of the systems associated with the left emergency AC bus feed cable resulted from the cable being damaged by the fire. The failure of this cable occurred late in the sequence of events when the fire was well developed. Although the loss of associated systems would have compounded the already significant challenges being faced by the pilots, and could have contributed to the loss of control of the aircraft, it is likely that the fire environment, and not the loss of the various aircraft systems, was the crucial factor in the eventual outcome. The design of the MD-11 is such that even if all of these cables become de-powered, there would be limited, but sufficient, capability remaining to allow the pilots to maintain control of the aircraft.

Federal Aviation Regulations (FAR) 25.1353(b) states that "[c]ables must be grouped, routed and spaced so that damage to essential circuits will be minimized if there are faults in heavy current-carrying cables." The objective is to minimize the impact of the failure of a heavy current-carrying cable on any essential system wiring. The wording implies that such minimization measures need only be taken when a wire bundle contains both essential systems wire or wires and heavy current-carrying cable or cables. The guidance material does not specify what measures would be acceptable to meet the requirements of FAR 25.1353(b). Neither does FAR 25.1353(b) specifically address, from a wire separation perspective, the acceptability of grouping or bundling power cables that may be deemed to be part of the essential system wiring. In addition, interpretation of this regulation is made more difficult because several terms, such as "essential circuits," are not defined by the regulator.

In aircraft design, it is not always possible to maintain physical separation between wires, especially in the cockpit area where, typically, space available for installations is confined. There are no clear guidelines about what would constitute an alternate means of achieving compliance when physical separation is not practical or possible. For the MD-11, the manufacturer used protective sleeving, and considered it capable of providing an equivalent level of safety to physical separation. As there has been no history of problems in the MD-11 or DC-10 fleet over many years of service, this method has evidently served the purpose; however, neither the MD-11 manufacturer nor the FAA has quantified the effectiveness of such protective sleeving.

The lack of clarity of the guidance material is highlighted by the difficulty in making compliance determinations about how the routing of the emergency and battery power bus feeds in the MD-11 should be viewed. That is, if FAR 25.1353(b) applies to the wires in question, it is unclear whether the wire bundles are permitted to contain essential system wiring along with the heavy-current-carrying cables, even for short lengths. For example, the wire run near the overhead switch panel housing might be interpreted as not complying with FAR 25.1353(b), because physical separation was not achieved; however, the FAA's interpretation of this installation was that the wire run complied. The basis for this interpretation is not clear in that there is no specified method of providing for an alternate means of compliance to FAR 25.1353(b) for cases where physical separation is not practicable or workable. A review of the regulations and guidance in this area would be appropriate.

2.13.4.2 Electrical wire insulation mixing

The FAA recognizes that mixing of wires whose insulation materials have different hardness characteristics can cause damage, especially in high-vibration areas. While there are no regulations pertaining to the mixing of wire insulations, FAA ACs 43.13-1B and 25-16 provide some guidance. AC 43.13-1B constitutes a general guide that provides acceptable methods, techniques, and practices for aircraft inspection and repair, while AC 25-16 supplements AC 43.13-1B with respect to the topic of electrical fault and fire prevention.

AC 43.13-1B is clear on the issue of wire mixing in that it states the "routing of wires with dissimilar insulation, within the same bundle, is not recommended." AC 25-16 suggests that the mixing of wires with "significantly different" insulation hardness properties should be avoided. Beyond relative wire-to-wire hardness, AC 25-16 also indicates that consideration should be given to the hardness factor between wire insulation and insulation-facing material, such as clamps or conduits.

The FAA relies on the aircraft manufacturer or modifier to establish material compatibility through prior satisfactory service experience or tests. To this end, Boeing's material compatibility tests have established an inventory of wires and insulation-facing material that, in its view, are suitable for use in the same bundles. Boeing-manufactured MD-11 wire bundles were designed and installed in accordance with acceptable industry standards to minimize wire-to-wire chafing damage and damage from wire-facing materials, such as clamps. Although after-market installations, such as in-flight entertainment (IFE) systems, may use the same or similar wire types as used by the aircraft manufacturer, the wire-to-wire compatibility would depend on the quality of the installation.

2.13.4.3 Reporting of wire-related discrepancies

At the time of this occurrence, there was no requirement to report wiring anomalies as a separate and distinct category of discrepancy. Consequently, in many cases, wiring discrepancies were attributed to a component or line replaceable unit within the associated aircraft system. Additionally, many wiring discrepancies are repaired in situ without a full appreciation of the consequences of the anomaly being revealed. The lack of a dedicated Joint Aircraft Systems/Components Inspection Code (enhanced Air Transport Association codes) limited the development of methodologies to collect, compile, and monitor data regarding wire problems for trend analysis. Although more specific wiring information is now being recorded by technicians and regulatory inspectors, and progressively more data are becoming available to facilitate the validation of potential wiring deficiencies, the previous lack of guidance material for reporting wire-related failures resulted in the capture of limited historical data, which continues to hamper the evaluation of the nature and extent of wiring-related safety deficiencies.

2.14.1 Operational impact of the IFEN integration

The design philosophy of the MD-11 is such that all "non-essential" passenger cabin equipment be powered by one of eight cabin buses. Activation of the CABIN BUS switch, located in the cockpit overhead switch panel, is designed to isolate all "non-essential" power to the cabin. This action is the first item in the Swissair MD-11 Smoke/Fumes of Unknown Origin emergency checklist and enables the crew to assess whether the smoke is originating from a component associated with the cabin bus system. During the initial review of the IFEN documentation it was determined that the IFEN power supplies were connected to aircraft power in a way that was incompatible with the emergency electrical load-shedding design of the MD-11.

Documentation shows that initially, the intention was to power the IFEN system from the cabin buses. However, the cabin buses could not provide sufficient power for the full 257-seat configuration of the IFEN system that was originally planned. Therefore, 115 volts (V) alternating current (AC) Bus 2 was used to satisfy the majority of the IFEN power requirements.

Powering the IFEN from the 115 V AC Bus 2 would not have constituted a latent unsafe condition if the design had included a means of deactivating the IFEN system (e.g., by use of a switching relay) when the CABIN BUS switch was selected to the OFF position. An alternate method of complying with the MD-11 type certificate would have been to seek FAA approval of an FAA-approved Airplane Flight Manual supplement to provide the pilots with relevant instructions on how to deactivate the IFEN system during emergency procedures. However, neither of these alternatives was pursued, and the design flaw was not discovered until after the SR 111 occurrence. Therefore, pilots were not likely aware that the IFEN system would remain powered after the cabin bus was deactivated.

The design of the IFEN system-to-aircraft power integration constituted a latent unsafe condition. However, as the fire was underway at the time the CABIN BUS switch was used (13 minutes, 7 seconds, after the initial smell was noted), no link was established between this latent unsafe condition and the initiation or propagation of the fire.

2.14.2 FAA oversight (surveillance) of the IFEN STC project

In its capacity as a Designated Alteration Station (DAS), Santa Barbara Aerospace (SBA) was responsible for ensuring that the IFEN system complied with existing regulations, and that it was safely integrated into the aircraft design. As SBA was operating on behalf of the FAA, it was the responsibility of the FAA to ensure that SBA had the expertise to carry out its duties. At the time this Supplemental Type Certificate (STC) was being certified, the FAA procedures in place to oversee the delegation of authority to a DAS for STC certification did not ensure that anomalies could be identified and corrected.

As reflected in the electrical load analysis document used in the initial IFEN design and development work completed by Hollingsead International (HI), there was an intention to power the IFEN from the cabin bus. As the IFEN development work progressed, HI determined that there was insufficient electrical power available from the cabin bus, and changes were made to the drawings to take power from the 115 V AC Bus 2. It could not be determined how much of the preliminary design work by HI was shared with SBA. The Letter of Intent (LOI) that was submitted by SBA to the FAA reflected what appeared to be the initial intention for the installation. While an amendment would be expected with such significant changes, the LOI was not amended to reflect the design changes. Also, the FAA review process to accomplish the oversight function was unlikely to discover such anomalies, as it relied on being notified by the DAS of any change to the scope of the project.

2.14.3 IFEN system design and analysis requirements

Part of the certification process required that a safety analysis be carried out on the IFEN system in accordance with the provisions of FAR 25.1309. This analysis evaluates hazards associated with both the system's operation and failure modes. The level of effort to accomplish such an analysis ranges from a qualitative assessment, such as a functional hazard assessment based on experienced engineering judgment, to a complex quantitative assessment, such as a failure modes effects analysis, which includes a numerical probability analysis. The IFEN system's functional criticality, assigned by the STC applicant in its LOI to the FAA, was described as "non-essential, non-required."^{Footnote 119} Such a categorization would allow a qualitative analysis to be conducted based on prior engineering judgment and satisfactory past experience.

Based on the qualitative analysis done by SBA, the operational impact of this STC on cockpit workload and procedures was seen by SBA as minimal or non-existent throughout the IFEN project. As well, others involved in its design, certification, installation, testing, and operation presumed that the "non-essential, non-required" designation confirmed that whether failing or operating normally, the IFEN installation would have no adverse affect on aircraft cockpit operations. Consequently, the only testing that was completed on the IFEN installation was the electromagnetic interference/RF and system failure tests. Neither of these tests was required to determine whether the IFEN was powered in such a way that it degraded a critical emergency procedure, such as the one used to disconnect electrical services in the passenger cabin.

Use of the term "non-essential, non-required" likely created an environment in which normal cautions and defences that may have identified the design deficiency were reduced; however, there are also shortcomings in FAR 25.1309 that can allow critical design deficiencies to go undetected.

The provisions of FAR 25.1309 require that a system safety analysis be conducted in a manner that tests the impact of the operation of the system, during both normal operations and during failure modes. The initial step in this process is a functional criticality assessment, which tends to focus on the consequences of the failure of the system. When the outcome of a system's failure is deemed to be "minor," as in the case of most IFE installations, the system safety analysis is considered complete. However, assessing the consequences of the failure of a system as being either "minor" or "major," based only on whether it is capable of operating properly and failing benignly, does not confirm that it has been safely integrated into the aircraft.

Typically, detailed or quantitative integration analysis is reserved in FAR 25.1309, for those systems whose failure modes are deemed to have a "major" impact on safe flight and landing of the aircraft. This process serves to informally classify a given system as either "essential" or "non-essential"; therefore, the IFEN system installed in the Swissair MD-11s was designated as "non-essential, non-required." As an outcome, there was no minimum level of quantitative "integration" analysis required by FAR 25.1309, to ensure the system's compatibility with aircraft type-certified procedures, such as emergency load-shedding. Such an analysis would have established whether the system had been integrated in a manner compliant with the MD-11 type certificate.

2.14.4 FAA aircraft evaluation group role/STC involvement

The FAA Los Angeles Aircraft Certification Office was supported in their review of the IFEN STC by the FAA's Aircraft Evaluation Group (AEG) personnel, including Flight Standards Aviation Safety Inspectors who were experienced in air carrier operations, flight crew training, aircraft maintenance, and the aircraft certification process. These AEG personnel are responsible for conducting certification and operational suitability determinations for new and modified transport aircraft. Although the FAA delegates many of its responsibilities with respect to the STC certification process, it does not delegate the function of the AEG. Therefore, the DAS did not have a mandate to make determinations about STCs in areas of either operational or maintenance requirements.

In the case of STC ST00236LA-D, SBA submitted an LOI in which it concluded that there was no impact on the flight crew workload. The AEG reviewed the LOI and affirmed that conclusion. As only the AEG has the authority to make such a conclusion, the presence of such a statement in the LOI should have alerted the FAA that SBA had exceeded its DAS mandate. The fact that the IFEN installation was designated "non-essential, non-required" led to reduced vigilance and a de facto delegation of this AEG function.

An FAA survey of similar "non-essential, non-required" IFE system STCs revealed that approximately 10 per cent had been designed, installed, and certified in such a way that prevented the flight crew from removing electrical power from the entertainment system without interfering with essential systems. Although the extent of the AEG participation in the approval of these other STCs was not determined, the survey revealed that the incomplete nature of the operational review prior to the approval of STC ST00236LA-D, was not unique.

As the AEG function is not delegated, the FAA is responsible for determining operational and maintenance conformance of an STC. Therefore, the AEG has the responsibility to remain engaged in the process and work closely with the DAS to deliver an appropriate approval.

2.14.5 IFEN STC project management

Swissair's decision to acquire a state-of-the-art IFE system for its MD-11 fleet was a business decision. Historically, the airline relied on its MD-11 maintenance provider, SR Technics, to manage any modification work on its MD-11 aircraft. However, after SAir Group was restructured and SR Technics became a separate business entity, Swissair also had the option of acquiring modification services from contractors other than SR Technics. For the IFEN project, Swissair elected to enter into a contract with Interactive Flight Technologies (IFT) to provide all the necessary design, certification, and integration services required to install the system. Because this type of arrangement was not provided for in SR Technics' existing contract with Swissair, the airline entered into a separate agreement with SR Technics to furnish IFT with all necessary support to allow IFT to accomplish the MD-11 IFEN modification. Therefore, while Swissair regarded IFT as the overall IFEN project manager, it considered SR Technics as the sole agency responsible for the continuing airworthiness of its MD-11 fleet.

IFT met its contractual arrangements to Swissair by subcontracting significant portions of the IFEN project. Although subcontracting did not relieve IFT of its overall project management responsibilities, the subcontracting created a project management challenge because IFT did not have the expertise to verify the work of its subcontractors. This situation was compounded by the fact that IFT's prime subcontractor, HI, further subcontracted the delivery of the IFEN project certification services. Consequently, the critical portion of IFT's contractual responsibilities to Swissair became twice-removed from it, further complicating its ability to oversee the delivery of an FAA-approved STC.

Typically, a prime contractor would select a subcontractor based on the subcontractor's reputation, and on the fact that it is certified by the FAA or an equivalent government authority. The expectation exists that a certified company will be able to adequately perform the duties for which it is engaged, and that certified companies are subjected to an effective oversight program by the applicable government authority.

The FAA is the ultimate authority, and therefore is responsible for ensuring that an STC project does not compromise the type certificate of an aircraft certificated under its jurisdiction. In fulfilling this responsibility the FAA relies extensively on its DAS delegate system. The FAA holds the DAS accountable as the primary authority with respect to certification services on any STC project. At the same time, the FAA does not expect a DAS to conduct the same level of surveillance on companies performing STC work as would be required by the FAA in its certification of those companies. The FAA accepts that the DAS can expect that an FAA-certified company will be able to meet the minimum required FAA performance levels, even if that company is not required, by contract, to use its FAA certification directly in a given project.

The project management of the IFEN project did not follow the typical pattern used in the FAA delegation process. SBA was not in charge of the project and did not provide project management. Instead, SBA was contracted by HI, which the FAA would view as working under the authority of SBA. To a large extent, SBA relied on the reputation and FAA's certification of HI to ensure that the IFEN system was properly designed and integrated.

Along with HI and IFT, SBA also relied on SR Technics to provide a level of QA during each IFEN installation. SBA certified the IFEN system based on its assessment of the documentation provided by HI.

The overall result was that the IFEN STC project management structure did not ensure that all the required elements were in place to design, install, and certify a system that would be compatible with the MD-11 type certificate.

The data available regarding aircraft accidents involving in-flight fires illustrates the limited amount of time available to react to the first indications of a potential fire. In the case of SR 111, the pilots noticed an unusual odour in the cockpit at 0110:38, and 20 minutes, 40 seconds, later the aircraft struck the water.

The pilots were at a significant disadvantage when attempting to assess and react to the initial odour and smoke. They did not have detection devices that could have provided accurate information about the source of the odour and smoke. Nor did they have the capability to distinguish with certainty between odour and smoke from an air conditioning source, an electrical source, or a materials fire.

Initially, the pilots sensed only an abnormal smell (see Section 1.18.8.3). About 20 seconds later, at 0110:58, they observed a small amount of smoke entering the cockpit from behind and above them. The initial smoke quickly disappeared. More than two minutes later, they confirmed that smoke had reappeared, likely in the same area. Analysis of the information collected during the investigation indicates that the odour and smoke were migrating from a fire that likely started at the cockpit rear wall above the cockpit ceiling. Assessment of the airflow patterns in the cockpit would support the migration of some smoke from this area into the cockpit via a seam, or some holes, between the upper avionics CB panel and the overhead ceiling panel near the right overhead air diffuser. If the pilots interpreted that the smoke was entering through the overhead air diffuser, this would have contributed to their belief that the odour and smoke originated within the air conditioning system. As the fire initially migrated primarily aft into the area above the forward cabin drop-ceiling, the amount of smoke entering the cockpit would have likely been small and intermittent. The smoke would also have been significantly diluted by mixing with the diffuser air.

Based on the typical awareness level shown by other pilots during interviews, the SR 111 pilots would not likely have been aware of the presence of significant amounts of flammable material in the attic area of the aircraft. As a result, they would not have expected there to be a significant fire threat from that area, or from any other hidden area. There was nothing in their experience that would have caused them to consider the smoke to be associated with an ongoing uncontrolled fire consuming flammable material above the ceiling. Industry norms at the time of the SR 111 occurrence were such that other flight crews, if faced with the same scenario, would likely have interpreted the limited cues available in a similar way.

Based on historical data, it is generally accepted that smoke from an air conditioning system source does not pose an immediate threat to the safety of the aircraft or passengers, and that the threat can be mitigated through isolation procedures. Based on their assessment that the risk from the smoke was relatively low, it appears that the pilots saw no apparent reason to accept the additional risk of attempting an immediate emergency landing. Instead, they established priorities that included obtaining the information needed for the approach and preparing the aircraft for a safe landing. Initially, the amount of smoke entering the cockpit must have been low. Otherwise, it would be expected that they would have attempted to isolate the smoke origin by closing off the conditioned air sources. There is no indication on the aircraft's recorders that they completed any action item in the Air Conditioning Smoke checklist, although, the first action item on that checklist, which is selecting the ECON switch to the OFF position, is not a recorded parameter on the FDR. The first item on the Smoke/Fumes of Unknown Origin Checklist that was recorded on the CVR was carried out about 13 minutes after the odour first became apparent.

The pilots donned their oxygen masks approximately five minutes after they first detected the unusual odour (see Section 1.18.8.4). From what is known of their actions before they donned their oxygen masks, they were not affected by the smoke in any physical way, such as irritation to the eyes or respiratory tract. The materials that were burning would have emitted fumes that would contain noxious and potentially toxic combustion by-products. Exposure to these compounds in sufficient concentrations, particularly through inhalation, could affect performance and judgment.

See the supporting technical information on this topic.

When the pilots started their descent toward Halifax at 0115:36, they had assessed that they were faced with an air conditioning smoke anomaly that did not require an emergency descent. Based on the perceived cues, they took steps to prepare the aircraft for an expedited descent, but not an emergency descent and landing.

The pilots were unfamiliar with the Halifax International Airport and did not have the approach charts readily available. The back-course instrument landing approach to Runway 06 was not pre-programmed into their flight management system (FMS). The pilots knew that they would have to take additional time to familiarize themselves with, and set up for, the approach and landing. They were given the weather information by the crew of an overflying aircraft, but did not know the runway lengths or orientation. Having the runway and instrument approach information available is normal practice and is important in carrying out a safe approach and landing, particularly at an unfamiliar airport at night.

In addition to these flight management circumstances, the pilots were aware that the meal service was underway, and that it would take some time to secure the cabin for a safe landing. Given the minimal threat from what they perceived to be air conditioning smoke, and the fact that there were no anomalies reported from the passenger cabin, they would likely have considered there to be a greater risk to the passengers and cabin crew if they were to conduct an emergency descent and landing without having prepared the cabin and positioned the aircraft for a stabilized approach and landing. It can be concluded that the pilots would have assessed the relative risks differently had they known that there was a fire in the aircraft.

The pilots also knew that the aircraft was too heavy for landing without exceeding the maximum overweight landing limits for non-emergency conditions. This would have been viewed as posing some risk, although it can be assumed that it would not have deterred them from continuing for an immediate landing, and dumping fuel during the landing approach, if they had perceived a significant threat to the aircraft. Coincident with their declaration of an emergency condition, the flight crew indicated that they were starting to dump fuel and there are indications that they did so.

2.17.1 Potential ignition sources – General

There is no indication that the fire started outside the reconstructed fire-damaged area. The fire-damaged area contained numerous electrical wires and cables, along with light fixtures, an emergency lights battery pack, two electrically powered galleys, numerous module block electrical connectors, and electrically operated door mechanisms. Testing showed that MPET-covered insulation material can be readily ignited from an arcing event; however, MPET tended to shrink away from sources of high heat, such as might be generated by resistance heating at an under-torqued electrical power or ground wire connection. Various potential ignition sources, including electrical and non-electrical, were evaluated within the fire-damaged area. It was determined that the most likely ignition source was an electrical arcing event involving breached wire insulation that ignited nearby MPET-covered insulation material.

2.17.2 Arc-damaged cables and wires

Each of the arcs on the recovered 20 cable and wire segments was analyzed to determine whether it could have been the cause and origin of the fire, or whether the arc was created as a result of the fire. This process involved attempting to identify the system to which each of the arced cables and wires belonged and, where possible, its installed location in the aircraft.

Three arced wires were determined to be from particular aircraft systems, and the arc locations were accurately positioned in the aircraft. Had any of the three wires been involved in a lead arcing event, the pilots would most likely have noticed the associated loss of function, or the failure event would have been recorded on the FDR. There is no indication that either occurred.

There were nine arced wires for which no definitive location within the aircraft could be determined. For several of these nine arced wires, the arcing event could be reasonably linked to one of the known system-related failures captured on the FDR during the 92 seconds between the first recorded failure and the stoppage of the FDR recording. As these recorded failures occurred about 14 minutes after the initial detection of an unusual smell in the cockpit, these failures and associated arcs were determined not to be involved directly in the lead ignition event.

The remaining eight cable and wire segments with arcing damage were from the IFEN installation. The individual PSU cables and the control wire were assessed for possible involvement in the initial arcing event. Most of the arcing on the IFEN cables and wires could be attributed to fire-related damage; however, the arc located at 9 cm (3.5 inches) from the end of the Exhibit 1-3791 IFEN PSU cable segment could not be attributed to fire-related damage. Regardless of which conduit was used for the routing, with the cables and wires positioned as described in Section 1.14.11.2, this arc would have occurred just forward of manufacturing station (STA) 383, above the right rear cockpit ceiling just outside the forward end of the conduit.

2.17.3 Airflow, fire propagation, and potential ignition locations

The pre-fire airflow patterns were assessed to determine potential locations from which odour and smoke could enter the cockpit as noted by the pilots, and not be noticed in the passenger cabin. Each of these potential locations was then assessed to determine whether a fire originating at that location would match the known circumstances of the SR 111 fire. Factors that were considered included the presence of potential ignition sources and flammable materials; the likelihood that the fire could propagate from that area in the known time frame, given the amount of flammable material available; the likelihood that fire propagation from that area could result in the known sequence of aircraft systems anomalies; and the likelihood that a fire propagating from that area could produce the observed fire damage.

Of all of the potential locations analyzed, one area, on the right side close to the cut-out in the top of the cockpit rear wall just forward of STA 383 was found to match all the known circumstances involved in the fire. From this area, odour and smoke could migrate into the cockpit at a location where it could be interpreted as smoke coming from the air conditioning system via the right overhead diffuser outlet. Initially, smoke generated in this area would not likely be evident elsewhere in the aircraft. A fire could propagate rearward from the area near STA 383, and based on known material flammability characteristics and airflow patterns as described below, the fire could return with more intensity into the cockpit after a time delay. This succession of events could occur before the fire would affect the passenger cabin environment or aircraft systems.

A fire starting farther forward in the cockpit on the underside of the over-frame insulation blankets, ahead of the wires and wire bundles that cross laterally in front of STA 383, would likely have initially propagated over a larger area within the cockpit. If the fire were to start at a more forward location, fire-induced system malfunctions and failures would likely have occurred earlier and the associated symptoms would likely have been evident to the pilots early in the fire sequence and potentially been captured on the recorders. In addition, smoke would be expected to initially enter the cockpit from locations where the pilots would not likely have associated it with a conditioned air source. The cockpit ceiling liner would also be susceptible to early fire penetration and melting, inasmuch as the liner is fabricated from a thermoformable plastic that has a relatively low forming temperature.

Similarly, if the fire had started at a more inboard location on the underside of the over-frame insulation blankets, close to the aircraft centreline, the fire would be essentially bounded on both the left and right sides by wire runs that are routed in a fore and aft direction. These parallel wire runs enter the overhead switch panel housing through the oval holes on the aft side of the housing. The wire runs would be expected to act as fire barriers that would channel flame spread in a fore and aft corridor. As shown during flight tests, smoke would be expected to be drawn into the openings of the overhead panel housing and into the cockpit through passageways, such as the engine fire shut-off handle slots in the overhead panel. Again, smoke penetration into the cockpit through locations such as these would likely not be associated with having originated from conditioned air sources. The same reasoning would also apply to fires originating on the left side of the cockpit attic. These factors negate the plausibility of the fire originating elsewhere in the hidden areas of the cockpit.

2.17.4 Fire propagation from an arc fault near STA 38

2.17.4.1 General

A detailed assessment was conducted to determine whether the known conditions and subsequent events could be accounted for if the fire started just forward of the cut-out in the upper portion of the right cockpit rear wall near STA 383.

2.17.4.2 Initial fire propagation

An arcing event just forward of STA 383 near the front of the 102-cm (40-inch) long conduits, would have the potential to ignite MPET-covered insulation blankets. Ignition of MPET-covered insulation blankets at the STA 383 arc location would initially generate a small creeping flame that would produce a small amount of smoke, with a relatively strong accompanying odour. Most of the smoke and odour would initially be carried by the airflow being continuously drawn down the air space adjacent to the ladder assembly into the avionics compartment, from where it would be filtered and exhausted overboard.

The small flame would slowly propagate across the underside of the MPET-covered over-frame insulation blankets. It could not travel very far forward before being blocked or redirected by a series of wire bundles that contact the insulation blankets in this area. The fire would not likely travel up and across the underside of the over-frame insulation blankets against a prevailing airflow down the ladder. Also, there are some wires and wire bundles that are routed on the cockpit ceiling that would act as fire barriers. It is possible that the fire could propagate down the ladder with the prevailing airflow; however, the flame front would encounter a series of horizontal wire support brackets that would act as fire barriers. Although it is possible that the fire could migrate around obstructions such as these, no physical evidence was found to indicate that the fire had propagated into the avionics compartment, because other than soot, there was no fire damage in that area.

2.17.4.3 Initial odour and smoke in the cockpit

If the flame front was able to propagate a relatively small distance inboard before predominantly propagating aft, it is likely that odour or smoke generated near STA 383 would momentarily be drawn into the cockpit through the holes and air gaps near the top of the avionics CB panel. Even if the flame front did not propagate sufficiently inboard for this to occur, it is likely that odour and smoke would enter the cockpit through these locations during the early stages of the fire. This would be expected to take place soon after the fire ignited the MPET-covered muff assembly adjacent to the smoke barrier or the insulation blanket on the riser duct assembly. In testing, smoke released over the front surface of the upper avionics CB panel near the rear right cockpit wall was initially blown downward before swirling back upward, eventually following a corkscrew path forward toward the flight crew seats.

The smoke would have to travel a relatively turbulent path before reaching the pilots. It would become more diffused, and it is likely that the smoke would initially present a weak visual indication. Therefore, the pilots would most likely detect an odour before seeing smoke. The most likely area where smoke would eventually be visible, would be in the vicinity of the avionics CB panel near the rear right cockpit wall. The density of the smoke would be greatest where it first enters the cockpit. The right overhead diffuser would accelerate the motion of the smoke, making it easier to detect. The smoke would also be in proximity to the overhead dome light, which would enhance the detection of airborne smoke particulates.

2.17.4.4 Fire propagation aft – Out of the cockpit

A small flame front could travel aft from the initiating location and pass over the cockpit rear wall through the cut-out. If present, the foam material used around the conduits and wire runs at the cockpit cut-out would either melt, or ignite and create additional smoke and odour.

When the small flame front passed over the cockpit rear wall, it is likely that for a short time the smoke was no longer migrating into the cockpit in sufficient quantity to be visible. Most of the smoke and odour would be expected to be exhausted down the ladder area during this interval. This condition would change once the fire ignited the MPET-covered muff assembly adjacent to the smoke barrier, or the insulation blanket on the riser duct assembly. Ignition of this insulation blanket would create additional smoke and odour that would ultimately be directed to areas near the smoke barrier. Airflow tests show that smoke and odour present in these areas could also migrate into the cockpit through openings in the smoke barrier.

Soon after the MPET-covered muff assembly was ignited, it is likely that a small propagating flame front breached, to some extent, the exposed Galley 2 silicone elastomeric vent cap. This vent cap is located immediately adjacent to the forward end of the muff assembly, next to the cockpit rear wall, adjacent to the smoke barrier. Air would immediately be drawn through the breached opening into the galley vent duct assembly, as soon as the vent cap was penetrated. This airflow would likely extinguish the small propagating flame front on the muff assembly in the area immediately adjacent to this vent cap. In testing of MPET-covered insulation blankets, air currents typically extinguished small propagating flame fronts.

It is also likely that the burning silicone elastomeric end cap would be extinguished at the same time owing to the sudden and continuous draw of air through the spot where initial fire penetration took place. Flame propagation along MPET-covered insulation blankets could still be taking place elsewhere, since by the time the Galley 2 vent cap was ignited, flame propagation would have likely spread over a much larger area including onto the riser duct assembly. The draw of air through the vent cap would also be expected to be small, causing only a localized air current effect. Once the fire intensified in the riser duct area and propagated onto the right fuselage side wall, the vent cap likely would have reignited or melted, resulting in the complete failure of the vent cap. This would create a much larger opening and a much larger draw of air into the vent duct system. The early draw of air and combustion by-products into the vent duct system could delay the return of smoke and odour into the cockpit, and delay the early detection of the fire in the passenger cabin.

The vertical air spaces adjacent to the centre riser duct, and between the aft side of the aft riser duct and the forward side of the R1 door frame, would channel hot combustion by-products, and create a chimney plume effect that would produce concentrated heat in areas above these air spaces. This plume effect would be further promoted by the vertical walled-in confinement of the MPET-insulated lower section of the riser duct assembly. Evidence of a high-temperature chimney plume effect was apparent in the wreckage that corresponded to these locations.

The eventual complete fire-related failure of the Galley 2 vent cap would cause a large volume of air to be drawn into the galley vent system at that location and would significantly change airflow patterns. A high-temperature fire damage pattern was found on ducts adjacent to the vent cap location. Overall damage patterns in the area are consistent with hot combustion by-products being drawn past the waterfall area, then forward underneath the riser ducts toward and into the galley vent duct system. The flow of hot combustion by-products, between the underside of the aft riser duct and the CD 207 ceiling panel below it, would create a significant localized convective heat effect on the panel. High-temperature fire damage of this nature was found on a piece of a CD 207 panel. This piece of panel most likely came from the sliding ceiling panel used at the R1 door location. Heat on this piece was consistent with a temperature exposure of 593°C (1 100°F) for a duration of 10 minutes.

2.17.4.5 Fire affecting IFEN PSU cables above galley 2

The lower portions of the fuselage frames at STA 401 and STA 410, between plane 15 right and plane 15 left, exhibited high-temperature damage. In addition, localized high-temperature damage was also found on some polyimide-insulated wires in the FDC wire run, concentrated between STA 401 and STA 410. This wire run is routed adjacent to the middle conduit on the ceiling above Galley 2. These heat damage patterns are consistent with localized high-temperature chimney plume effects created by the presence of a vertical air space on each side of the centre riser duct along its outboard face. The tops of the two chimney plumes intersect the ceiling at STA 401 and STA 410.

When the IFEN control wire and PSU cables are positioned to simulate the outboard conduit, the cable layout matches the overall damage pattern in the assembly, with five wire arc locations aligning at approximately STA 401. This is consistent with the fluorinated ethylene-propylene conduit and ethylene-tetrafluoroethylene (ETFE) wire insulation being preferentially melted through at this location, causing multiple wire-to-wire arcing events. These events would likely trip the associated CBs and sever the wires at some arc locations, opening the electrical circuit and de-energizing these power cables.

2.17.4.6 Fire affecting IFEN PSU cable outside aft end of conduit

Concentrated high heat damage was found directly above the R1 door, flapper door ramp deflector and above the adjacent wire bundles in the waterfall area. This damage was manifested in the form of broomstraw-like features on a localized region of the R1 forward door track that is attached to the bottom of the fuselage frames. On such a robust part, high heat is required over a relatively long time to create damage of this type. The high heat damage at this location is consistent with a chimney plume effect that channelled hot combustion by-products upward and impinged on the ceiling. The location of the broomstraw-like heat damage corresponds to the area above the inside radius of the elbow connection for the riser duct assembly. This geometry, together with other factors, such as the alignment of a vertical air space between the aft side of the aft riser duct and the cabin interior wall panel, favoured the formation of a plume as the MPET-covered insulation blanket combusted on the riser duct assembly. Further corroboration of such an event having taken place was the presence of other broomstraw-like features immediately adjacent to the same location, on the lower portions of an intercostal between STA 427 and STA 435, and nearby along the lower portions of a frame at STA 442 between plane 15 right and plane 15 left. Additional localized heating in the waterfall area would occur as hot combustion by-products were drawn under the riser ducts to the Galley 2 vent duct.

This localized heating would account for the missing tin coating on the three recovered IFEN PSU cables between STA 420 and STA 427, just aft of where they exited the conduit. At this location, the Exhibit 1-3790 PSU cable had arcs on each of its three phases. This same cable had also arced further forward within the conduit. The two separate arc locations on this cable are consistent with the fire propagating in the fore-to-aft direction, first causing an arc to take place at the forward position, not tripping the CB, then subsequently causing a second arc near the waterfall area that tripped the CB. The absence of arcs on the other two recovered PSU cables from the waterfall location, specifically in the area where the tin coating was missing from these cables, is consistent with these two cables being de-energized when the arc occurred on Exhibit 1-3790 at the waterfall location. This latter observation is also consistent with the two other PSU cables being previously de-energized by the tripping of their respective CBs when the multiple arcing events took place in the conduit. The latter further supports a fore-to-aft direction of fire propagation.

2.17.4.7 Fire progression – Riser duct area to the left side of the fuselage and aft

The burning of relatively large quantities of MPET insulation blanket cover material in the vicinity of the riser duct assembly would create a significant heat release. Although some of the combustion by-products would continue to be drawn down the ladder area and into the breached Galley 2 vent duct system, most of the by-products would flow upward in hot buoyant plumes. These by-products would form a hot buoyant layer along the upper attic air space above the forward cabin drop-ceiling.

The smoke barrier assembly would initially prevent most of the hot combustion by-products from flowing forward into the cockpit attic air space. Some leakage would be expected to take place, which would allow some by-products to penetrate into the flight crew compartment. Combustion by-products would also be drawn down the engine fire shut-off cable drop, where smoke could also leak into the cockpit interior. An indication of that flow having taken place was the presence of soot on some of the interior surfaces of the recovered cable drop shroud pieces.

The hot combustion by-products would heat the ceiling insulation and other items, including those below the hot buoyant layer, by processes such as radiant heating. Preheating and subsequent ignition of other materials would take place, including the ignition of the metallized polyvinyl fluoride (MPVF) insulation blanket cover material and splicing tape on the ducts. This in turn would be expected to cause ignition of the silicone elastomeric end cap situated on the end of the conditioned air branch duct, located approximately 30 cm (12 inches) aft of the cockpit door, above the ceiling panels. Failure of the end cap would cause a continuous release of conditioned air, which would further exacerbate the fire. An indication that this end cap had been breached by the fire was the presence of high heat damage on recovered portions of the branch duct where the cap was situated.

Release of conditioned air out of the branch duct would be directed slightly upward and laterally across the aircraft, toward the Galley 1 vent duct plenum, situated approximately 46 cm (18 inches) away from the end cap. This forced air ventilation would be expected to not only deliver conditioned air, but also entrain hot combustion by-products with it. A hot airflow (convective oven effect) would likely be created in certain areas along flow lines. Owing to the geometry of the ducts in the area, the flow would be channelled along a tapered path toward, and over, the top of the exposed portion of Galley 1. Indications that a hot airflow existed in this area were the broomstraw-like features that were present on the lower surfaces of intercostals and frames in the vicinity, and heat damage to the top of Galley 1. There was also high heat damage concentrated on the inboard side of the intercostals, which face the branch duct.

It is likely that the fire-induced failure of the branch duct silicone elastomeric end cap preceded and contributed to the failure of at least one, if not both, of the Galley 1 vent duct hose connections. The hoses were constructed from a fibreglass cloth, which was impregnated with a red-coloured silicone-like rubber material. Failure of the hose connection or connections would draw air and combustion by-products into the vent duct assembly. This exhaust ventilation would further exacerbate the fire. Indications that hose failure had taken place at some point during the fire was indicated by the abrupt cessation of heat damage along the top outboard face of Galley 1 at an elevation that corresponded to one of the hose connections, and by the presence of high-temperature heat damage on pieces of vent duct assembly just outboard of Galley 1.

The presence of high heat in the attic air spaces would likely cause the nylon fasteners holding the MPET-covered over-frame and between-frame insulation blankets to melt and fail. This would allow portions of the insulation blankets, or whole insulation blanket assemblies, to fall free, exposing more flammable MPET cover material to the fire. This in turn would significantly add to the growth and intensity of the fire.

The hot buoyant layer above the forward cabin drop-ceiling would be free to flow aft toward the empennage of the aircraft above the passenger cabin ceiling. Some of these by-products would continue to be drawn into the recirculation fan intakes, while these systems were operating. After passing through the intakes, the by-products would be delivered to areas within the passenger cabin. Soot patterns found on items such as wire support brackets, and on and within an overhead stowage bin located at STA 1780, indicate that the attic space above the passenger cabin probably became filled with combustion by-products. No smoke was reported in the passenger cabin prior to the flight recorders stopping.

2.17.4.8 Progression of the fire into the cockpit

Before the pilots selected the CABIN BUS switch to the OFF position at 0123:45, the airflow above the forward cabin drop-ceiling would have predominantly been in an aft direction, toward the input of the recirculation fans. Some smoke and combustion by-products would have been migrating into the cockpit. Several soot deposits were found in various places to indicate such seepage. At about this time, it is likely that the fire breached the silicone elastomeric end cap on a short branch stub on an air conditioning duct located immediately aft and overhead of the cockpit door. This would have allowed a large volume of conditioned air to enter the area and augment the fire. This additional airflow would have rapidly accelerated the propagation of the fire, as indicated by the high heat damage observed on the surrounding ducts and aircraft structure.

Selecting the CABIN BUS switch to the OFF position would shut down the recirculation fans, and result in a reversal of the airflow above the forward cabin drop-ceiling. With the airflow then moving predominantly forward, hot combustion by-products would have been drawn toward the cockpit attic air space.

It is likely that the weakened smoke barrier would have completely failed shortly after the CABIN BUS switch was selected to the OFF position. Although it is possible that the smoke barrier could have failed earlier, this is considered unlikely, because such a failure would have likely led to an earlier failure of the thermoformable plastic cockpit ceiling liner, which melts within a relatively low temperature range. Following the breach of the smoke barrier, hot combustion by-products could then freely fill the cockpit attic air space. The fill rate would likely exceed the exhaust rate, and a significant rapid build-up of heat and combustion by-products would occur. Hot combustion by-products would penetrate, fill, and rapidly heat the air spaces behind the avionics CB panel, overhead CB panel, and overhead panel housing. The MPET- and MPVF-covered insulation blankets above the cockpit ceiling would provide additional combustible material to the fire. This would further contribute to the amount of smoke entering the cockpit through passageways, such as the engine fire shut-off handle slots, and the various cut-outs in the cockpit ceiling liner.

The rapid heating of the air spaces and electrical components behind the CB panels, and within other assemblies, would have caused aircraft systems to malfunction. The heat would have thermally tripped some CBs that would likely have resulted in many of the anomalies that were subsequently recorded. For example, the Autopilot 2 disconnect event took place approximately 20 seconds after the CABIN BUS switch was selected to the OFF position; this was followed shortly thereafter by a series of recorded system anomalies.

The right side of the cockpit ceiling primarily consists of several aluminum panels that would act, in combination with other metallic assemblies such as the conditioned air diffusers, as a physical barrier to the fire and its combustion by-products. In contrast, the cockpit ceiling on the left side consists mainly of liner material that would soften, sag, and melt when exposed to high temperatures.

As the fire entered the cockpit attic area, the heat would have first affected the most exposed surfaces of the ceiling liner just forward of the cockpit door, in the area aft of the diffuser, and in the left overhead region. Very little liner material from these areas was identified in the wreckage. The few pieces that were identified, such as a portion of the cockpit spare-lamps cover and hinge (located in the ceiling adjacent to the cockpit coat closet), showed signs of melting. Some of the liner material may have been consumed by the fire. Pieces of the liner from other areas appear blackened and burned along some edges. Other pieces were also melted, and some had flowed until their cross-sectional area was reduced to the thinness of paper.

Based on the high temperatures involved, it is likely that the breach of the ceiling liner occurred approximately one minute after the smoke barrier failed. The breach of the ceiling liner may have corresponded to the time the pilots declared the emergency at 0124:42. Most of the fire damage on the cockpit carpet was likely the result of portions of the melted ceiling liner dropping on it. Larger amounts of dense noxious smoke and hot combustion by-products would be expected to have immediately penetrated through openings in the cockpit ceiling liner.

Once the cockpit liner had been breached, the openings in the liner would be expected to progressively expand, allowing a further increase in the volume of dense noxious smoke and combustion by-products into the cockpit. The smoke would be drawn down through the openings next to the rudder pedals into the avionics compartment. Visibility within the cockpit would be expected to become progressively worse.

It is likely that the fire would have breached the silicone elastomeric end cap situated on the end of a conditioned air branch duct, located above the lower assembly of the left overhead cockpit ceiling liner, just forward of the cockpit coat closet. The insulation cover splicing tape installed over the MPVF-covered muff assembly, which fixes the muff assembly in place over the end cap, would provide a source of combustible material. Once the tape was ignited, the integrity of the muff assembly would be lost and ignition of the silicone end cap would likely soon ensue. Heat damage and melting were found on the edges of the recovered liner at a location immediately adjacent to the end cap's position. Failure of the end cap would cause conditioned air to be continuously blown out the branch duct above the ceiling liner, in close proximity to the MPET-covered over-frame and between-frame insulation blankets, exacerbating the fire situation. It is likely that the hose to the individual air outlet near the centre of the left overhead cockpit ceiling liner was also breached, causing a similar effect.

Portions of a fuselage frame and conditioned air duct assembly near the hose and hose connection exhibited high-temperature damage. Cone calorimeter^{Footnote 120} tests indicate that material similar to the hose in question ignites at a heat flux of 25 kW/m2 (which is approximately equivalent to a surface equilibrium temperature of 591°C (1 095°F)), and it is probable that the hose would not withstand exposure to such high temperatures. The same would also apply to the hose for the other individual air outlet located further forward in the liner, to the left of the overhead CB panel. Similar high-temperature fuselage frame damage was found nearby. Failure of the silicone elastomeric end cap and the individual air outlet hoses would introduce conditioned air to the fire, which would likely contribute to the deteriorating environment within the cockpit.

As the MPET cover material was consumed by the fire, the underlying fibreglass batting in the insulation blankets would become exposed and then badly scorched by the high temperatures and flames. The forcible release of conditioned air in close proximity to the insulation blankets would likely disturb and release fibreglass particulates from the ashen surfaces and from the less-damaged areas underneath these surfaces where the adhesive binder would be degraded.

After the completion of burn tests, the release of clouds of small particulates was observed to take place whenever the burnt insulation blankets were disturbed or removed from the test fixtures.

The captain's location would have been more directly in line with the area of the cockpit ceiling liner that was first breached. A higher percentage of the combustion by-products would be expected to flow directly toward the captain's seat location, and be drawn down into the avionics compartment through the captain's rudder pedal openings. The situation in the cockpit would have continued to deteriorate as systems malfunctioned and failed, owing to the effects of the fire.

Eventually, molten aluminum began to drip in the area of the right observer's seat, as indicated by the presence of resolidified aluminum deposits that were found on the recovered pieces of the seat. A 2024 aluminum alloy deposit was found on a screw on the right side of the seat pedestal, as well as on the right lap belt. There were also remnants of other aluminum deposits immediately adjacent to the 2024 aluminum alloy deposit on the belt. The type of alloy or alloys on these remnants could not be determined, as there was insufficient material available for analysis. Also, a 6061 aluminum alloy deposit was found on the CB for the seat, which is located near the rear right corner of the seat pedestal.

The sources of the aluminum deposits could not be conclusively determined; however, the possible areas from which 2024 aluminum alloy deposits could fall onto the right observer's seat are limited. Assuming that the integrity of the overhead dome light and the 6061 aluminum alloy diffuser assemblies were not compromised during the fire, the only major opening that could be created in the ceiling directly above the right observer's seat would be along a narrow rectangular-shaped area that predominantly comprises ceiling liner material. This area is approximately 7.5 cm (3 inches) in width by 76 cm (30 inches) in length. High heat damage is evident on portions of the recovered pieces of the diffuser assemblies and fuselage frames from above this location. Most of the upper edge of the recovered pieces of the avionics CB panel also exhibited high heat damage.

One known potential source of 2024 aluminum alloy is the AN 929-6 cap assembly, which is located on the crew oxygen supply line at STA 374. The end cap is situated above, and immediately adjacent to (within about 2.5 cm (1 inch)) the narrow rectangular-shaped area described above. This oxygen line cap assembly is in close vertical alignment with the right edge of the right observer's seat, near the right lap belt location and near the right side of the seat pedestal, when the seat is in the forward-facing position with the armrests stowed upright. Indications of broomstraw-like features were found along the bottom edges of the fuselage frame at STA 374 just above, and adjacent to, the cap. This further indicated that high temperatures had existed at this location.

Testing on the oxygen cap assembly indicated that before leakage or failure of the cap occurred, it would have to be heated at elevated temperatures for several minutes (see Section 1.14.13). These elevated temperatures were below the temperature at which external melting was visible on the cap. Therefore, if the time at which the CABIN BUS switch was selected to the OFF position is used as a reference for when significant elevated heating took place in the cockpit attic air space (approximately 8 minutes, 30 seconds, prior to the time of impact), the most likely time frame that melting of the cap could take place would correspond to the final stages of the flight.

If pure oxygen leaked from the cap during the fire, there would almost certainly be a quick and dramatic increase in the fire intensity. This would be expected to rapidly lead to a complete failure of the cap. A complete failure of the cap would result in a loss of pressure in the line and would abruptly stop the flow of oxygen to both pilots' oxygen masks. In addition, full venting of the line would be expected to quickly lead to a flashover within the cockpit, or an intense conflagration, or both. There was little physical evidence of an overall high-temperature damage pattern in the cockpit interior; therefore, it is likely that if this occurred, it was of a very short duration, and it occurred immediately prior to the time of impact.

The first indication to the pilots of a systems-related failure was the disconnect of the autopilot at 0124:09 (see Section 1.18.8.6). Twenty-four seconds prior to this, at 0123:45, the captain had selected the CABIN BUS switch to the OFF position. This selection is the first action item in the Swissair Smoke/Fumes of Unknown Origin Checklist. Until that point, it appears that the conditions in the cockpit were such that the pilots perceived that they were dealing with smoke from an air conditioning source.

The airflow testing showed that with the recirculation fans off, as would be the case after the CABIN BUS switch was selected to the OFF position, the predominant airflow in the forward attic area reverses direction so that instead of flowing aft toward the fans, much of the air flows forward into the cockpit attic area, and then down through the cockpit into the avionics compartment below the cockpit.

Between the time the captain selected the CABIN BUS switch to the OFF position at 0123:45 and when the flight recorders stopped recording at 0125:41, the fire-related effects in the cockpit began. This is confirmed by the rapid succession of systems-related failures. The environmental conditions in the cockpit also began to deteriorate rapidly, with an increasing amount of smoke, heat, and fire entering from overhead.

The systems failures up to that point, would have reduced the ability of the pilots to control and navigate the aircraft, especially at night, with smoke in the cockpit, and in instrument meteorological conditions. The loss of the autopilot would have added to the pilots' workload, and the associated warbler warning tone that sounded until the end of the CVR recording would have been disconcerting. The master caution light would have illuminated with the loss of flight control computer 1, Channel A at 0124:57; it is unknown whether the pilots reset the master caution light. The loss of the left emergency AC bus at 0125:06 would, in part, have caused the loss of the captain's display units (DU) 1 and 3. DU 2 would show a red X, and the master caution light would illuminate. Again, it is unknown whether the pilots reset this caution light; however, if they did, the loss of the captain's pitot heat, about 10 seconds later, would have triggered the master caution light again. These failures would have been accompanied by numerous fault messages, cues, and alerts. Dealing with such a barrage of faults and messages would have been confusing, distracting, and difficult to cope with.

The loss of all three of the first officer's DUs at about 0125:30 would have forced him to use the standby instruments to maintain aircraft spatial orientation (see Section 1.18.8.21). The transition to the standby instruments would have been challenging because of their small size and positioning, relative to each other, especially in the deteriorating conditions (increasing smoke and heat) of the cockpit.

At that point, although the captain may have restored all primary flight display information, (such as aircraft attitude, airspeed, heading, and altitude) on DU 2, DUs 1 and 3 had failed and it would have been impossible to restore these two displays. Although all three 115 V AC generator buses were functional at the time of impact, fire damage to distribution buses, wires and cables, and CBs disrupted the electrical power to some, or all (if DU 2 was lost) of the systems that provided primary attitude information, navigation, communications, and various other functions. Consequently, the pilots would have been dealing with a multiplicity of tasks, many of which were highly abnormal, while the cockpit environment was rapidly deteriorating.

The final 5 minutes and 37 seconds of the flight, from when the flight recorders stopped at 0125:41, were not recorded on the FDR or the CVR. To the extent possible, the events that occurred were reconstructed using information from ground-based primary radar data, full-authority digital electronic control non-volatile memory data, air traffic control (ATC) recordings, witness statements, and wreckage examination.

An analysis of the heat damage observed on the reconstructed cockpit wreckage, together with the likely fire propagation scenario, shows that the fire increased in intensity during the final six minutes of the flight. The amount of smoke, heat, and fire entering the cockpit would have continued to increase.

There are indications that at 0125:50, about eight seconds after the flight recorders stopped, the pilots switched the air data source to air data computer (ADC)-2 from ADC-1 (see Section 1.18.8.26). This was most likely done in an attempt to recover some lost flight instrumentation. The wire examination shows that the left emergency AC bus, which powered ADC-1, experienced an arcing event. The arcing would have caused it to become de-powered, resulting in the loss of ADC-1. When the pilots selected ADC-2, it temporarily restored the transponder Mode C altitude information, which showed the aircraft to be at 9 700 feet. At 0126:04, transponder information stopped being transmitted from the aircraft for the remainder of the flight. ATC radar equipment continued to record the aircraft track on primary radar until it disappeared from the radar screen about 10 seconds before the aircraft's impact with the water.

In their second-last transmission to ATC at 0124:53, the pilots reported that they were starting to dump fuel. There are some indications from witness information that they initiated fuel dumping after the recorders stopped. Also, the auxiliary tank isolation valve was found closed, which would be expected if fuel dumping had commenced. The fuel dump valves were closed at the time of impact, indicating that the fuel dumping had been stopped by the pilots.

Before the recorders stopped, the pilots indicated that they needed to land the aircraft without delay. Despite this, the aircraft continued on its southbound track away from the airport and out toward the ocean. This suggests that the condition in the cockpit quickly deteriorated to a point where the pilots were unable to effectively navigate the aircraft. They would likely have lost most of their electronic navigation capability, and the increasing amount of smoke entering the cockpit would have made it progressively difficult to see out the windscreens to navigate visually, especially in unfamiliar territory at night and with cloud layers in the vicinity.

The aircraft continued to descend in a right turn as it passed over the community of Blandford, Nova Scotia. Witnesses on the ground described hearing a noise having a repetitive beat frequency and that was generated at a constant rate and superimposed on the loud engine sound. Engine 2 was being shut down at about this time; however, no explanation for this "repetitive beat" noise could be established. People also described seeing various aircraft lights, indicating that at least some of the aircraft electrical systems were still powered. This was confirmed by the examination of various systems such as fuel pumps and fans, whose rotating components showed signs of being powered at the time of impact. Examination of components indicated that all three generator buses were being powered at the time of impact.

Shortly after passing the Nova Scotia coastline, the aircraft started a right turn. Although indications are that the captain's clearview window was likely unlocked, it is unknown when or whether the window was ever opened. At some point, the pilots selected the flaps to the pre-selected 15-degree DIAL-A-FLAP setting. When they shut down Engine 2 at about 1 800 feet, approximately one minute before the time of impact, the airspeed was about 227 knots true airspeed. The average rate of descent just prior to this time was estimated to be about 2 000 feet per minute.

The reason for the Engine 2 shutdown prior to the time of impact is unknown. One possible explanation is that the crew received a false fire warning indication. A short-circuiting of the ground wire in the Firex Handle 2 could cause both the Firex Handle 2 lights and Engine 2 fuel switch light to come on. The ground wire was not identified; however, the ground wire was installed in an area of high heat and fire damage. One of the cockpit emergency checklist booklets was found to have some minor heat distress on the page describing the "ENGINE - FIRE" procedure; however, it is unknown whether the checklist was being used during the engine shutdown. Closing the FUEL switch is part of this checklist procedure.

The passenger cabin environment would have been significantly less hostile than the cockpit environment. Although soot was noted in the attic area aft of the main fire area, there were no signs of appreciable heat in the attic aft of the first-class seats. The ceiling panels used in the passenger cabin have a significant resistance to fire and heat penetration and would have protected the passenger cabin from the effects of the fire. Some smoke would probably have been entering the passenger cabin during the last few minutes of the flight, especially at the front of the cabin.

It is unknown whether any firefighting took place using the available fire extinguishers. Based on examination, it was determined that neither of the two portable 5 lb dry chemical extinguishers mounted in the cabin were likely used. Three of the six 2.5 lb Halon portable extinguishers were not likely used; however, the charge state of the three remaining Halon extinguishers could not be determined because of the physical damage to the extinguishers. If firefighting took place, it would be expected that the M/C would have been involved; the M/C was seated at the time of impact with his seat belt fastened.

One of the passengers, who was a pilot, was wearing a life vest at the time of impact. There were no other indications that anyone else had donned a life vest, although no definitive conclusions were possible in most cases. It is unknown whether this passenger had donned his life vest by instruction or through his own initiative. If he had donned the life vest on his own, he must have been able to discern or surmise that the aircraft was over water and was in danger of ditching. If it was a result of a crew instruction, then there must have been a plan to ditch the aircraft. It would then be expected that the M/C would have been wearing his life vest, which he was not; this suggests there was no instruction to prepare for ditching.

In the last minutes, other than possibly having an electronically generated heading on DU 2, the pilots would have had no electronic means of navigating to the airport, and would have been forced to consider alternatives, such as attempting a crash landing on land or ditching into the ocean. From the wreckage examination, it is known that the fire in the cockpit created heat damage signatures of 482°C to 538°C (900°F to 1 000°F) on the forward portion of the avionics CB panel and on the air diffuser structure just above the cockpit ceiling. There was evidence that melted material had dropped down on the carpet and on the right observer's seat cover. The fire was encroaching on the pilot seat positions from the rear of the cockpit. The heavy soot deposits, and the heat-damaged condition of some of the cockpit materials, indicate that visibility would have been significantly obscured within the cockpit. It could not be determined whether the cockpit fire extinguisher had been used.

The first officer's seat was occupied at the time of impact; the captain's seat was in the egress position. Although the standby attitude display showed the aircraft to be at 20 degrees nose down, and 110 degrees right bank at the time of impact, it could not be determined whether these indications represented the actual aircraft attitude at the time of impact. The structural damage supports a nose-down attitude of about 20 degrees, and a right bank in excess of 60 degrees. If the pilots were not incapacitated and were still attempting to control the aircraft, this suggests that in the last minute of the flight they lost orientation with the horizon. This would not be unexpected, given the lack of reference instrumentation, and lack of visual cues from outside the aircraft. Regardless of whether there was pilot input at the time of impact, the aircraft was not in controlled flight.

2.20.1 General

This section examines the actual flight profile of SR 111 and the optimal theoretical emergency descent profile. The theoretical calculations were undertaken solely to provide an academic reference baseline, and did not take into account any of the cues upon which the SR 111 crew decisions were based. Also not taken into account were the actual adverse factors that would have had a significant negative effect on the ability of the pilots to maintain an optimal descent profile and to land the aircraft.

See the supporting technical information on this topic.

2.20.2 Earliest possible landing time

Theoretical calculations show that if an emergency descent had been started from the optimum starting point at 0114:18, the earliest possible landing time would have been 0127. This landing time would only have been possible if there had been no technical malfunctions or adverse cockpit environmental conditions inhibiting the ability of the pilots to navigate and configure the aircraft to obtain its optimum performance capabilities. Any deviation from these "ideal" conditions would result in a later landing time because either the aircraft would require extra manoeuvring off the direct track to the airport, or the aircraft would reach the airport with too much altitude or airspeed to land.

2.20.3 Effect of fire-related failures on landing

At 0124:09, nearly three minutes before the earliest possible landing time, the aircraft had started to experience an increasingly rapid succession of systems-related failures. The pilots declared an emergency at 0124:42, slightly more than two minutes before the theoretical earliest possible landing time. Several additional systems-related failures, including the loss of the first officer's DUs and communications with ATS, occurred one minute later (0125:42), just prior to the stoppage of the flight recorders.

By the time the recorders stopped, the cockpit environment was rapidly deteriorating. The fire was invading the cockpit from the overhead ceiling area. Just before the recorders stopped, the pilots indicated that they needed to land immediately; however, they apparently lost their ability to navigate, as they did not steer the aircraft toward the airport. At some point within the last five minutes, the aircraft's slats became unserviceable. Based on heat damage to wires and associated CBs, it is also possible that the auto ground spoilers, auto-brakes, and anti-skid braking system would have become inoperative before the aircraft could have landed. Under such conditions, it would have been impossible to stop the aircraft on the available runway even if it could have landed.

Based on these factors, it is evident that even if the pilots had attempted a minimum-time emergency diversion starting at 0114:18, it would have been impossible for the pilots to continue maintaining control of the aircraft for the amount of time necessary to reach the airport and complete a safe landing.

2.20.4 Theoretical emergency descent calculations

By coincidence, the time at which an emergency descent would have needed to begin to achieve the optimum theoretical emergency descent profile to land at the Halifax International Airport coincided with the actual time of the Pan Pan radio transmission. Any delay in descending would mean that the aircraft would be above the ideal descent profile. During the Pan Pan transmission, the captain requested a diversion and suggested Boston. It was not until about 1 minute and 25 seconds later that the following events were completed: the controller offered Halifax as an alternative diversion airport, the pilots evaluated and accepted Halifax, and the pilots commenced a non-emergency but rapid descent.

During that time, the aircraft was travelling in the general direction of the Halifax International Airport at a ground speed of more than 8 nautical miles (nm) per minute. From the actual descent start point, it would not have been possible for the pilots to position the aircraft for a landing on Runway 06, without some form of off-track manoeuvre to lose altitude and slow to the appropriate speed. In a best-case scenario, the extra manoeuvring would have added two or three minutes to the landing time. More likely, a manoeuvre such as a 360-degree turn would have been necessary, or they would have had to switch to a different runway. Either choice would have added several minutes to the earliest possible landing time, and the effects of the fire would have negated the possibility of completing a safe landing.

At about 0125, when the fire condition became distinctly evident in the cockpit, the aircraft was about 25 nm from the airport, at an altitude of about 10 000 feet, and at an airspeed of about 320 knots. It was flying in a southerly direction, away from the airport. In optimum circumstances, from that point it would have taken a minimum of about six minutes to get to the runway.

Theoretical calculations confirm that from any point along the actual flight path after the aircraft started to descend, it would not have been possible for the pilots to continue maintaining control of the aircraft for the amount of time necessary to reach the airport and complete a landing.

An evaluation of the available information indicates that the fire likely started within the confines of a relatively small area above the right rear cockpit ceiling just forward of the cockpit rear wall near STA 383. Although other potential areas were assessed, no other area was found that so comprehensively explained the initial indications of odour and the subsequent smoke and fire propagation. Support for the fire initiating and spreading from this localized area includes the following:

• The presence of electrical wires as potential ignition sources and easily ignited MPET-covered insulation blanket material;
• The known environmental conditions in the cockpit and cabin;
• The time frame in which the fire propagated from initial detection until the fire-related failures of various aircraft systems occurred;
• The air-flow patterns; and
• The fire and heat-damage patterns.

Within the localized area where the fire most likely started, a wire arcing event is the only plausible ignition source. There were several wire bundles containing hundreds of wires, including the four IFEN PSU cables and 16 American Wire Gauge (AWG) control wire, that passed through the localized area (see Section 1.6.1.4). It is most likely that the fire started from a wire arcing event that ignited the nearby MPET-covered insulation blankets. These MPET-covered insulation blankets are easily ignited and were prevalent in the area (see Section 1.16.8).

Of all the wires and cables that were located in the localized area of interest, the only arc-damaged wire that could be positioned in that area with relative accuracy was the 1-3791/1-3793 pair of IFEN PSU cables (see Section 1.14.11.2). Although it is possible that other wires from this localized area that were not recovered might also have arced, the only arcing event that is known to have occurred within that area is the forward arc on Exhibit 1-3791, located just forward of STA 383.

An assessment was completed to determine whether the forward arc on Exhibit 1-3791 could have been the result of fire damage, and therefore, would not have been involved with the lead arcing event. This possibility was considered unlikely. For this forward arc on Exhibit 1-3791 to be the result of fire damage, the fire would have to start from another unrelated arcing event within the localized area, and the fire would need to be sustained in the area for a sufficient time to melt and breach the ETFE wire insulation at the site of the forward arc on Exhibit 1-3791. To result in arcing at this site, the breached wire would have to be in contact with either grounded aircraft structure, or with a second wire of different electrical potential whose insulation was also breached by the fire. It is unlikely that a fire would selectively breach only one wire in Exhibit 1-3791 and breach at least one additional nearby wire to create conditions for an arc event to occur without also breaching the insulation on at least some of the other five wires in the 1-3791/1-3793 pair. It is unlikely that the insulation on these other five wires was breached at that location, as there were no arcs on these five wires at that location.

The forward portions of the 1-3790 and 1-3792 PSU cables, and the 16 AWG control wire, were not identified and may not have been recovered. Therefore, in the area where the forward arcing event occurred on the 1-3791 PSU cable, it is not known whether arcing occurred on either the 1-3790/1-3792 cable pair, or the 16 AWG control wire. However, as both of these PSU cables and the 16 AWG control wire subsequently arced at locations that were at least 50 cm (20 inches) farther aft, any arcing that might have occurred at the forward location did not trip the associated CB.

Given the number of unlikely circumstances and events that would be required, a scenario involving fire-related damage leading to the forward arc on Exhibit 1-3791 at the STA 383 location cannot be supported.

If the forward arc on Exhibit 1-3791 was not the result of fire-related damage, another potential scenario is that the arc occurred during the time of the lead arcing event; that is, it was associated with the lead arcing event, either alone, in combination with arcing on another wire or wires, or as collateral damage from an arcing event on another adjacent wire or wires. In any of these potential scenarios, the arcing was not sufficient to trip the associated CB.

The forward arc on Exhibit 1-3791 was assessed to determine whether it was, by itself, the lead arcing event that started the fire. For this arc to be the single lead arcing event, the wire would first have to be damaged, for example by chafing, at the location of the arc, to expose the conductor. The exposed conductor would then have to contact grounded aircraft structure, resulting in the arcing event. Although it was possible to position the cable segment (Exhibit 1-3791), and therefore the forward arc, relatively accurately, the extent and nature of the damage required interpretation of the damage patterns. This interpretation allowed for a small range of possible locations in the placement of the wires, as described in Section 1.14.11.2. At the forward end of the possible range, the arc was placed where it would be in contact with an aluminum wire support bracket. However, the chafing of any one wire by itself to this bracket would not result in an arc, as the bracket was isolated from the aircraft structure by a nylon stand-off and would not have provided an electrical path to ground.

There was aluminum found in one copper bead adhering to the wire strands slightly removed from the main arc site of the forward arc bead on Exhibit 1-3791. This suggests that the arc might have resulted from contact with aluminum. Arcing to the aluminum bracket would only be possible if there were two exposed conductors in contact with the bracket. This would provide an opportunity for arcing, as aluminum is a good conductor of electricity. Such a scenario would involve, for example, two phases of a PSU cable chafing separately against this same bracket until both of their conductors became exposed. This scenario could not be ruled out; however, there is no corroborating information to support it. The bracket was not identified in the wreckage. Neither were the two remaining PSU cables, the 16 AWG control wire or other aircraft wires from that area, that may have been involved.

Another potential lead arcing event scenario involving the forward arc on Exhibit 1-3791 would be that the arc occurred directly to another wire of a different electrical potential. This could be either an aircraft wire, or another IFEN wire. In either case, both wires would have to be damaged at the location of the arc, allowing their bare conductors to contact each other. Because the IFEN wires in the STA 383 area were routed separately and not along existing wire bundles, it is less likely that the IFEN wires would be in contact with aircraft wires within the localized area where the fire most likely started; therefore, the more likely candidate wires for this type of scenario would be the other wires in the bundle of four IFEN PSU cables and the 16 AWG control wire. It is known that the other wires in the 1-3791/1-3793 pair did not arc at that forward location. However, the wires from the other pair of PSU cables and the 16 AWG control wire from that area were not identified. Therefore, neither aircraft wires nor other IFEN wires can be ruled out as potentially being involved in such a scenario.

Damage to two or more wires in a wire bundle can be caused by chafing contact with the aircraft structure, by inadvertent damage occurring during installation or subsequent maintenance, or by the presence of swarf, such as a metal shaving, that could cut through the insulation on both wires, exposing their conductors. A metal shaving could also act as a conductor. If any of those events occurred, the subsequent arcing that took place on all of the PSU cables and 16 AWG control wire confirms that any arcing on these wires near STA 383 did not trip the associated CB.

An assessment was made to determine whether the forward arcing damage on Exhibit 1-3791 could have resulted from collateral damage; that is, damage from an arcing event involving other wires in the immediate vicinity that was of sufficient magnitude to breach the insulation on at least two other wires, including Exhibit 1-3791. For this to occur, the lead-event wires would have to be in very close proximity to the forward arc on Exhibit 1-3791. An arcing event of sufficient magnitude to damage other wires would likely have tripped the associated CBs. None of the IFEN CBs tripped at the time of the lead arcing event (subsequent arcing occurred on all of the PSU cables and the 16 AWG control wire); therefore, if such an arcing event occurred, it did not involve IFEN wires. Such a lead-arcing event would have to involve aircraft wires, but not result in any electrical anomalies that would be apparent to the pilots and not be recorded on the FDR. Although the possibility of a scenario involving collateral damage to Exhibit 1-3791 could not be ruled out, it appears unlikely that such a scenario occurred.

No determination could be made regarding how the insulation at the forward arc location on Exhibit 1-3791 was initially breached, or what that wire came into contact with, such as structure or another wire, to cause the arc. Although the available information indicates that the forward arcing event on Exhibit 1-3791 occurred during the time of the fire-initiating event, and in the area where the fire most likely originated, it cannot be concluded that the forward arc on Exhibit 1-3791 was the lead arcing event. It appears likely that at least one other wire was involved in the lead arcing event; however, it could not be determined whether this was an IFEN wire or wires, one or more aircraft wires, or some combination of both.

An arcing event or events provided an ignition source for the fire; however, this arcing would not have resulted in a threat to the aircraft had there not been material nearby that could easily be ignited by such an ignition source. The presence of significant amounts of flammable materials allowed the fire to spread and intensify rapidly, which ultimately led to the loss of control of the aircraft.